ec: uniform shard block layout (#10932)

* ec: uniform shard block layout An EC volume is striped as 1GiB blocks until less than one row remains, then 1MiB blocks, and consecutive blocks land on different shards. With ec.encode's -fullPercent 95 against the 30GiB default limit, ~30% of every volume sits in that 1MiB tail, so a 4MB filer chunk there is five stripes on five servers. New encodes now use one block per shard, sized ceil(datSize/dataShards) rounded up to 1MiB and recorded in the .vif (EcShardConfig.block_size, also carried by the .ecsum manifest). A needle now maps to one shard unless it is larger than the block or straddles a boundary. The chosen size equals the legacy layout's padded shard length for every input, so shard sizes, capacity math, and the shard-size credibility checks are unchanged; only the byte placement moved. Reads, decode, and scrub resolve the block sizes from the volume's .vif; absence keeps the legacy interpretation, so existing EC volumes read exactly as before. Rebuild is layout-agnostic. weed fix -ecx recovers the layout from the .vif, else the .ecsum sidecar, and with neither de-stripes under both candidate layouts and keeps the one that indexes more valid needles. Same change in the Rust volume server, which now also streams the encode in 256KB sub-batches like Go instead of allocating whole blocks, and computes the large-row count as shardSize/largeBlock to match Go on exact multiples. On a 26MB fixture both encoders produce byte-identical shards, and a Go-written .vif parses in Rust with the block size intact. * ec: resolve the rust ecx rebuild through the recorded layout The Rust rebuild path regenerated a lost .ecx by scanning the logical .dat through a hand-rolled pure-1MiB striping, which was already wrong for legacy volumes with large-block rows and is wrong for any uniform volume with a block past 1MiB. Route the scan through locate_data with the .vif-recorded block size, the same mapping the read path uses. Also seed the new tests' random data instead of the deprecated global math/rand.Read. * ec: fail the Rust ecx rebuild on any shard read error A read error mid-scan published the entries collected so far as a successful .ecx, and read_at's byte count was ignored so a legal short read passed as complete — a truncated or failing shard could produce a silently incomplete recovery index. Exact-read semantics in read_from_data_shards, error propagation in the needle walk, and a truncated-shard regression test. * ec: fail the mount on an unreadable or malformed vif Both servers silently fell back to the legacy layout when an existing .vif could not be read or parsed. Every new encode records a positive uniform block size there, so the fallback mounted the same shards with legacy offset math and could return wrong data. Absent stays legal (legacy volumes predate the sidecar), and a zero-byte stub still reads as absent (Go's MaybeLoadVolumeInfo convention, now mirrored in Rust); a present-but-unreadable or malformed .vif fails the mount instead. * ec: bound the reconstruct fan-out of one needle's intervals A degraded interval fans out a read to every reachable shard location, each with a buffer the size of the interval. Reading a needle's intervals in parallel multiplied that by the interval concurrency: a needle spanning 8 blocks could hold 8 x MaxShardCount remote reads and buffers at once, where the sequential version peaked at MaxShardCount. Give each needle a single reconstruct budget its intervals share, held for the buffer's lifetime, so separate reads stay independent but one read cannot multiply its own fan-out. * ec: drop the duplicated shard-size formula calculateExpectedShardSize reimplemented the padding rule that UniformBlockSize already owns — TestUniformBlockSizeMatchesLegacyShardSize asserts the two agree for every input — so a change to the rule would have had to be made in both. Defer to the helper, keeping the historic answer for an empty .dat. * ec: resolve the shard block layout from whatever records it Four places still answered the layout question by inference when a record of it was available, or accepted an answer that was not one: - A mount with no .vif defaulted to the legacy layout; the bitrot sidecar records the same config at encode time, so take it when present, as weed fix -ecx already does. The vif itself is now parsed once per mount rather than twice. - The Rust ecx rebuild derived its row count from the padded shard extent, which under the legacy layout reads a shard that is an exact large-block multiple as one row too many. Pass the encode-time .dat size from the .vif and keep the extent as the fallback. - weed fix -ecx read the block size outside the EC-config guard (collapsing the unknown sentinel into a definitive legacy), only wrote the recovered layout back when the .vif was absent rather than unusable, and broke a scan tie by candidate order instead of the documented reach. - The uniform layout tripped writeDatFile's large-block ambiguity guard, which cannot apply when the large and small blocks are the same size. * ec: give the index-recovery tests a parseable vif The fixtures wrote the literal bytes "volinfo" as the source .vif and the recovery copies it verbatim, so the receiving server then mounted the volume from a .vif it could not parse. That used to pass by silently defaulting to the legacy layout; a mount now refuses a vif it cannot read, which is what the tests were exercising all along without meaning to. * ec: validate the layout a vif records, not just its syntax Review follow-ups on the mount-strictness change: - A .vif can parse and still record a block size no encoder could have produced (negative, or not a whole number of small blocks). Both servers took it and mapped every read through it. ValidateBlockSize / the Rust mirror now refuse the mount, the same way an unparseable vif does; 0 stays valid as the legacy two-tier layout. - The bitrot-sidecar fallback accepted parity_shards == 0 and summed the counts in their own width, so values near the ceiling wrapped past the MaxShardCount bound. Require both counts and sum in a wider type. - weed fix -ecx treated a config with only DataShards > 0 as usable, so a half-written .vif suppressed the recovery paths AND survived the rewrite. Require a complete, in-range config before trusting it. - Returning the vif-load error left the .ecx and .ecj descriptors open; repeated mount attempts on malformed metadata could exhaust them. * ec: refuse to act on a layout the metadata does not establish - The worker encode only logged a failed .vif write and skipped it in the distribution set, and treated the .ecsum write as best-effort. A worker whose disk filled after the much larger shards landed could still distribute, mount, verify shard inventory, and delete the source replicas — leaving holders with shards whose geometry nothing records. Both writes and both inclusions are encode success conditions now. - A generation-matching .ecsum that disagreed with the .vif geometry only disabled checksums in Go, and in Rust was not compared at all, so protection stayed On while reads used the other layout. Both files record the layout their generation was encoded with, so a disagreement now fails the mount. * ec: reject an invalid recorded block size in weed fix -ecx A .vif with valid shard counts but a negative or unaligned block size was marked usable: a positive invalid value pinned the scan to a geometry that de-stripes to garbage, and a negative one ran the dual scan but left the invalid .vif in place afterwards. Validate it with the same rule the mount applies, and when it fails leave the layout unknown so the scan recovers it and the file is rewritten. * ec: validate the sidecar layout weed fix -ecx recovers from The .ecsum fallback was taken on DataShards > 0 alone, so a CRC-valid sidecar carrying the wrong generation, an incomplete ratio, or an unaligned block size would pin the reconstruction to one incorrect uniform-layout candidate instead of letting the dual scan decide. Require generation 0, a complete in-range ratio, and a valid block size; anything less leaves the layout unknown, which is the answer that still recovers by scanning. * ec: let only a genuinely absent sidecar choose the legacy layout With no .vif the bitrot sidecar is the only record of a volume's layout, and the mount fallback read a failed load, an unusable config, or a sidecar stamped for another generation as "assume legacy". A uniform generation-0 volume could therefore mount with legacy or another generation's geometry and answer reads with the wrong bytes. Present-but-unusable now fails the mount; only actual absence keeps the legacy defaults. Shared as EcShardConfigFromSidecar so every caller reads the sidecar the same way. * ec: treat a recorded-but-impossible layout as corruption, not as legacy - A .vif whose ecShardConfig is PRESENT but records an impossible ratio was answered with the default 10+4 and the legacy block layout, in both languages. That reads a uniform volume's shards at the wrong offsets and returns the wrong bytes. Only an entirely absent config still means "this predates the record"; a present one that cannot be true fails the mount. - The shard-count bound summed two uint32 counts as int, which wraps on a 32-bit build: 0x7fffffff + 0x7fffffff lands at -2 and slips under MaxShardCount. ValidEcShardCounts sums in uint64, and every EC call site that checked a recorded ratio now goes through it. * ec: rebuild on the geometry the sidecar records, and flag it when it disagrees The rebuild RPC passes BackgroundECContext, so RebuildEcFiles resolves the layout itself — and it resolved a missing or invalid .vif to the default 10+4 with the legacy block size. Two consequences: a 12+4 volume was reconstructed through a 10+4 matrix, which produces wrong bytes and never regenerates shards 14-15; and the chosen geometry then contradicted a valid uniform sidecar, which loadRebuildSidecar reported as BitrotOff — silently skipping the input and regenerated-shard checksum checks precisely when the volume had already lost its metadata. The layout now resolves from the bitrot sidecar (found across the server's disks, not just beside the base name) before falling back to the defaults, and a present-but-impossible ratio fails instead of being replaced. A sidecar that contradicts the chosen geometry is BitrotInvalid, which the existing unsafeIgnoreSidecar override still lets an operator push past. * ec: let the Rust rebuild read metadata off a sibling disk read_ec_shard_config searches only the location the rebuild writes into, so a volume whose .vif or generation-0 .ecsum sits on another of the server's disks resolved to the default 10+4 with the legacy block layout — the Rust half of the geometry-guessing the Go rebuild just stopped doing. It then reconstructs a custom-ratio or uniform volume through the wrong Reed-Solomon matrix and de-striping geometry. The rebuild now looks for the .vif in its own location and then each sibling, falls back to the generation-0 sidecar wherever that lives, and only defaults when neither exists anywhere. The encode-time .dat size the ecx rebuild needs is resolved the same way. * ec: resolve a rebuild's vif from every directory that may hold it RebuildEcFiles probed only <data-base>.vif. The caller knows the selected location's index directory and the sibling locations, but passed neither for metadata: additionalDirs carried shard directories only, and were searched for shards and the checksum sidecar. A split -dir/-dir.idx layout, or a disk holding only shards, therefore resolved a pre-sidecar custom-ratio volume to 10+4 and reconstructed through the wrong matrix — never regenerating shards 14-15. The caller now hands over the index and sibling directories, and the resolver probes the vif across all of them, matching what the Rust resolver already does for both the vif and the sidecar. * ec: make every rebuild consumer agree on the layout it resolved - The post-rebuild bitrot backfill re-derived the geometry from this directory's .vif alone and dropped the block size entirely, so a rebuild that resolved its layout from a sibling, the sidecar, or a uniform vif wrote a manifest describing a DIFFERENT layout — one later mounts reject, or that covers only the default shard count. The layout is resolved once now, through an exported ResolveRebuildECContext, and the rebuild and the backfill share that answer. - The Rust rebuild collected only each location's data directory, so a sibling's INDEX directory — where a split -dir/-dir.idx layout keeps .ecx/.ecj/.vif — was never probed, and a custom-ratio volume still resolved to 10+4 with the legacy layout. Both directories of every location are carried now, deduped against the rebuild's own. - A shard delivery can bring the checksum manifest with it, but the receive path only writes the file: a server that already had the volume mounted kept its resolved protection state (off) until a remount. The mount RPC re-resolves it once the shards it describes have been added. * ec: cover the rebuild's directory search with tests Reviewers flagged the sibling index directory twice, and the fix that closed it had no test of its own: the assembly sat inline in the rebuild handler, reachable only through a gRPC call against a populated store. Lifting it into rebuildSearchDirs / select_rebuild_location makes the rule assertable — a sibling contributes BOTH its data and its index directory, a shared index directory is listed once, and the rebuild's own data directory never repeats. Writing the Rust cases surfaced that the two implementations do not agree on where the rebuild's own index directory belongs, and both are right: Go's resolver takes a single directory list, so that directory has to be inside it, while Rust's takes the rebuild's data and index directories as their own arguments and would search them twice. The tests now state which contract each side is holding to, so neither drifts into the other's shape. Pure refactor otherwise; no behaviour change. * ec: search the index directory for the layout sidecar The Rust resolver looked for the generation-0 .ecsum in the rebuild's data directory and the sibling list, but not in the rebuild's own index directory — while the .vif lookup directly above it did, and Go's findBitrotSidecar has always checked both bases. On a split -dir/-dir.idx location that directory is where the metadata lives, and callers leave it out of the sibling list precisely because it is passed here separately, so nothing searched it. With no .vif anywhere the sidecar is the only surviving record of the layout. Missing it resolved a 12+4 uniform volume to 10+4 with the legacy striping — the test added here fails with (10, 4, 0) against the old code — and the rebuild then reconstructs through the wrong matrix and writes .ecx offsets that no reader can follow. * ec: let the rebuild see its own index directory The Rust rebuild takes a single flat directory list — the shape Go's RebuildEcFiles uses — so it cannot be handed the rebuild location's index directory separately the way the layout resolvers are, and the handler was passing the sibling list, which deliberately omits exactly that directory. On a split -dir/-dir.idx location that is where .ecx and .vif live, so the shard and index lookups could not see them. Go has always carried that directory in additionalDirs; this lines the two call sites up. * ec: let a config-free vif fall through to the layout sidecar A .vif that carries no ecShardConfig answers nothing about the layout, so it is no more informative than an absent one — but both trees treated its mere existence as the end of the search. Go went straight to the 10+4 legacy defaults without consulting the sidecar at all; Rust returned whatever ec_shard_config_from could make of a single directory. A 12+4 uniform volume with a legacy config-free vif therefore resolved as 10+4 legacy, and every read landed at the wrong shard offset. The sidecar lookup was also single-directory on both sides, while a split -dir/-dir.idx layout keeps .vif and .ecsum with the INDEX. Go's findBitrotSidecar has always taken both bases; the callers here passed only the data base, and the Rust bitrot resolver derived its path from the data base alone. Rust's layout resolver now takes a candidate directory list — data, index, then any siblings — and searches all of it, which also removes the early return that made the vif's presence decisive. load_vif_info_across_dirs reported `dir` even when load_vif_info had found the vif in `dir_idx`. Nothing reads that field today, so this changes no behaviour; it stops the next caller that resolves the rest of the volume's metadata against the answer from being sent to a disk holding none of it. Absence stays legal throughout: a volume with neither record is genuinely legacy. Present-but-unusable still fails the mount, now in the config-free-vif branch too. * ec: activate a delivered sidecar on every per-disk runtime A vid mounts as one EcVolume per disk, each with its own resolved protection state, but the post-delivery reload used the first-match lookup and so touched exactly one of them. The siblings kept reporting no protection until a remount — and since shard distribution deduplicates the metadata files onto the first target disk for a node, the runtime that got the .ecsum is not necessarily the one the lookup returns. Iterate every runtime instead, via a new FindAllEcVolumes and its Rust mut equivalent. Combined with each runtime now resolving its sidecar against its index directory as well as its data directory, a server sharing one -dir.idx across its disks activates all of them from the single delivered copy. The Rust volume server had no post-mount reload at all; it gets one here, matching Go. * ec: resolve the delivered sidecar across every EC metadata directory Reloading every per-disk runtime, added last round, did not by itself make the delivered manifest reachable. Startup mirroring copies .ecx/.ecj/.vif to every shard-bearing disk so each mounts self-contained, but deliberately not .ecsum, and a repair delivers exactly one copy. Each runtime was resolving against its own two directories, so every sibling of the disk that received the file kept reporting no protection however often it reloaded. Resolve one authoritative copy across every EC metadata directory instead of duplicating the file. Mirroring .ecsum would have to keep pace with a file that is rewritten as shards are repaired, and would not help the reported case at all: the delivery happens at runtime, and mirroring only runs at startup. The regression test pins both halves — a reload restricted to the volume's own directories still finds nothing, and the same reload given the server's metadata directories turns protection on. * ec: ask every directory before writing a TOFU baseline After a rebuild the opportunistic backfill asks whether this volume already has a checksum manifest, and answered from the data base alone. A split -dir/-dir.idx layout keeps the sidecar with the index, and a multi-disk server may keep it on a sibling, so an existing manifest read as absent. The consequence is worse than a missed read. On a false "no" the backfill writes a fresh sidecar at the data base from whatever the shards say right now — and the data base is the first candidate every resolver checks, so that TOFU baseline shadows the real manifest rather than sitting beside it. A shard that was silently corrupt gets blessed, and the record that would have caught it stops being consulted. FindBitrotSidecar exports the search the package already used internally, so the question is asked of the data base, the index base and the sibling disks — the same candidates the rebuild resolves its layout from. * ec: refuse a shard block size no encoder could have produced weed fix -ecx derived one from the raw shard extent, so a truncated or partially copied shard wrote a .vif that NewEcVolume then permanently refuses — the volume the tool was run to rescue could never mount again. An extent that is not a whole number of small blocks cannot have come from a uniform encode, so it is no longer offered as a candidate, and nothing unvalidated reaches the .vif. Claude-Session: https://claude.ai/code/session_011FRRoNKBiGbH58rs2AQyA7 * ec: derive the .vif's dat size and block size from one measurement VolumeEcShardsGenerate stat'ed the .dat before the encode while WriteEcFiles stat'ed it again to size the blocks. A write landing between the two produced a .vif whose own two fields describe different files. WriteEcFiles now leaves both on the context, and fills a placeholder context in place so the caller can read them back. Claude-Session: https://claude.ai/code/session_011FRRoNKBiGbH58rs2AQyA7 * ec: keep the source volume until every holder serves its shard layout The uniform layout rides in a .vif field older volume servers never knew: they discard it, mount the shards as legacy and return wrong bytes with nothing erroring, and the shard files are the same length either way so no other check notices. The upgrade order lived only in the release note. VolumeEcShardsInfo now reports the block size the holder actually serves, in both the Go and Rust servers, and the pre-delete verification refuses to drop the source unless every reachable holder echoes the one the shards were encoded with — while a rollback still exists. A server that predates the field answers 0, which is the negative answer. Claude-Session: https://claude.ai/code/session_011FRRoNKBiGbH58rs2AQyA7 * ec: drop the rebuild's dead block-size parameters generateMissingEcFiles never reads largeBlockSize/smallBlockSize — Reed-Solomon reconstruction is layout-agnostic — so passing the legacy constants only advertised a layout the rebuild does not use. Also move UniformBlockSize's doc off ValidateBlockSize. Claude-Session: https://claude.ai/code/session_011FRRoNKBiGbH58rs2AQyA7 * ec: warn about EC defaults only when the mount used them The "vif file not found, using defaults" warning fired even after the bitrot sidecar supplied a non-default layout, sending anyone triaging wrong bytes after the legacy layout the volume never mounted on. Claude-Session: https://claude.ai/code/session_011FRRoNKBiGbH58rs2AQyA7 * ec: stat the distributed bitrot sidecar once The strict check re-stat'ed the file immediately before the stat that already gates inclusion, and a failed sidecar write now fails the encode outright, so the first could only fire on a deletion between the two lines. Claude-Session: https://claude.ai/code/session_011FRRoNKBiGbH58rs2AQyA7 * ec: say what the reconstruct budget actually bounds A shard's buffer stays in bufs until its interval reconstructs, which is after the read that filled it released its permit, so the semaphore bounds round trips in flight and not retained bytes. Peak memory is the intervals reconstructing at once times the shards each reaches times the interval size. Claude-Session: https://claude.ai/code/session_011FRRoNKBiGbH58rs2AQyA7 * test: let the fake volume server report its delivered EC layout The pre-delete verification now asks each holder which shard block layout it serves, and a fake that always answered "unset" looked exactly like a volume server too old to know the field. Distribution ships the .vif to every holder alongside its shards, so read the layout back out of it as a real holder does. Claude-Session: https://claude.ai/code/session_011FRRoNKBiGbH58rs2AQyA7
2026-09-08 15:41:15 +02:00 · 2026-08-28 20:46:59 -07:00
parent 93666c90e9
commit 88c873ecd4
39 changed files with 3621 additions and 516 deletions
@@ -539,6 +539,7 @@ message VolumeEcShardsInfoResponse {
    uint64 volume_size = 2;
    uint64 file_count = 3;
    uint64 file_deleted_count = 4;
+    EcShardConfig ec_shard_config = 10;  // the layout this holder serves reads through; a binary predating a field reports it as unset
 }

 message EcShardInfo {
@@ -612,6 +613,7 @@ message EcShardConfig {
    uint32 data_shards = 1;   // Number of data shards (e.g., 10)
    uint32 parity_shards = 2; // Number of parity shards (e.g., 4)
    int64 encode_ts_ns = 3;   // encode time (unix nanos); a read served from a shard of a different encode run is rejected
+    int64 block_size = 4;     // uniform block layout: each shard is a single contiguous block of this many bytes; 0 = legacy 1GiB/1MiB two-tier layout
 }
 // EcBitrotProtection is the entire content of a bitrot checksum sidecar
 // (<base>.ecsum for the legacy generation, <base>.ecsum.v<N> for vacuum
@@ -92,6 +92,57 @@ pub fn load_state_file(
    volume_server_pb::VolumeServerState::decode(data.as_slice()).ok()
 }

+/// One disk location's stake in an EC volume, as seen by the rebuild handler.
+struct LocInfo {
+    dir: String,
+    idx_dir: String,
+    shard_count: usize,
+    has_ecx: bool,
+}
+
+/// Picks the location a rebuild should write into — the one holding an `.ecx`
+/// and the most shards — and returns every other directory it may have to read
+/// from. Shards are only half of what the rebuild needs: a split
+/// `-dir`/`-dir.idx` layout keeps `.ecx`/`.ecj`/`.vif` with the INDEX, and on a
+/// multi-disk server the chosen disk may hold nothing but shards while this
+/// volume's `.vif` or generation-0 `.ecsum` sits on a sibling. Miss those and
+/// the layout resolution falls back to 10+4 with the legacy striping and
+/// reconstructs through the wrong matrix, so both directories of every other
+/// location are listed. The rebuild's own two are passed separately by the
+/// caller and dropped here, along with empties and duplicates.
+///
+/// Returns `None` when no location holds an `.ecx`, i.e. there is nothing to
+/// rebuild from.
+fn select_rebuild_location(loc_infos: &[LocInfo]) -> Option<(usize, Vec<String>)> {
+    let mut rebuild_loc_idx: Option<usize> = None;
+    let mut other_dirs: Vec<String> = Vec::new();
+
+    for (i, info) in loc_infos.iter().enumerate() {
+        let better = info.has_ecx
+            && rebuild_loc_idx
+                .is_none_or(|prev| info.shard_count > loc_infos[prev].shard_count);
+        if better {
+            if let Some(prev) = rebuild_loc_idx {
+                other_dirs.push(loc_infos[prev].dir.clone());
+                other_dirs.push(loc_infos[prev].idx_dir.clone());
+            }
+            rebuild_loc_idx = Some(i);
+        } else {
+            other_dirs.push(info.dir.clone());
+            other_dirs.push(info.idx_dir.clone());
+        }
+    }
+
+    let rebuild_loc_idx = rebuild_loc_idx?;
+    let rebuild_dir = &loc_infos[rebuild_loc_idx].dir;
+    let rebuild_idx_dir = &loc_infos[rebuild_loc_idx].idx_dir;
+    other_dirs.retain(|d| !d.is_empty() && d != rebuild_dir && d != rebuild_idx_dir);
+    other_dirs.sort();
+    other_dirs.dedup();
+
+    Some((rebuild_loc_idx, other_dirs))
+}
+
 struct WriteThrottler {
    bytes_per_second: i64,
    last_size_counter: i64,
@@ -2383,13 +2434,21 @@ impl VolumeServer for VolumeGrpcService {
            )
        };

-        // Check existing .vif for EC shard config (matching Go's MaybeLoadVolumeInfo)
-        let (data_shards, parity_shards) =
+        // Check existing .vif for EC shard config (matching Go's MaybeLoadVolumeInfo).
+        // The block size is recomputed by the encode for the current .dat, so
+        // only the ratio is carried over from a prior config.
+        let (data_shards, parity_shards, _) =
            crate::storage::erasure_coding::ec_volume::read_ec_shard_config(
                &dir, &idx_dir, collection, vid,
-            );
+            )
+            .map_err(|e| {
+                tonic::Status::internal(format!(
+                    "read ec shard config for volume {}: {}",
+                    vid.0, e
+                ))
+            })?;

-        if let Err(e) = crate::storage::erasure_coding::ec_encoder::write_ec_files(
+        let block_size = match crate::storage::erasure_coding::ec_encoder::write_ec_files(
            &dir,
            &idx_dir,
            collection,
@@ -2397,16 +2456,19 @@ impl VolumeServer for VolumeGrpcService {
            data_shards as usize,
            parity_shards as usize,
        ) {
-            // Cleanup partially-created .ecNN and .ecx files on failure (matching Go defer)
-            let base = crate::storage::volume::volume_file_name(&dir, collection, vid);
-            let total_shards = data_shards + parity_shards;
-            for i in 0..total_shards {
-                let shard_path = format!("{}.ec{:02}", base, i);
-                let _ = std::fs::remove_file(&shard_path);
+            Ok(block_size) => block_size,
+            Err(e) => {
+                // Cleanup partially-created .ecNN and .ecx files on failure (matching Go defer)
+                let base = crate::storage::volume::volume_file_name(&dir, collection, vid);
+                let total_shards = data_shards + parity_shards;
+                for i in 0..total_shards {
+                    let shard_path = format!("{}.ec{:02}", base, i);
+                    let _ = std::fs::remove_file(&shard_path);
+                }
+                let _ = std::fs::remove_file(format!("{}.ecx", base));
+                return Err(Status::internal(e.to_string()));
            }
-            let _ = std::fs::remove_file(format!("{}.ecx", base));
-            return Err(Status::internal(e.to_string()));
-        }
+        };

        // Write .vif file with EC shard metadata
        {
@@ -2425,6 +2487,7 @@ impl VolumeServer for VolumeGrpcService {
                        .duration_since(std::time::UNIX_EPOCH)
                        .unwrap_or_default()
                        .as_nanos() as i64,
+                    block_size,
                }),
                ..Default::default()
            };
@@ -2458,13 +2521,6 @@ impl VolumeServer for VolumeGrpcService {
            format!("{}_{}", collection, vid.0)
        };

-        struct LocInfo {
-            dir: String,
-            idx_dir: String,
-            shard_count: usize,
-            has_ecx: bool,
-        }
-
        let store = self.state.store.read().unwrap();
        let mut loc_infos: Vec<LocInfo> = Vec::new();

@@ -2512,26 +2568,8 @@ impl VolumeServer for VolumeGrpcService {
            ));
        }

-        // Pick rebuild location: has .ecx and most shards
-        let mut rebuild_loc_idx: Option<usize> = None;
-        let mut other_dirs: Vec<String> = Vec::new();
-
-        for (i, info) in loc_infos.iter().enumerate() {
-            if info.has_ecx
-                && (rebuild_loc_idx.is_none()
-                    || info.shard_count > loc_infos[rebuild_loc_idx.unwrap()].shard_count)
-            {
-                if let Some(prev) = rebuild_loc_idx {
-                    other_dirs.push(loc_infos[prev].dir.clone());
-                }
-                rebuild_loc_idx = Some(i);
-            } else {
-                other_dirs.push(info.dir.clone());
-            }
-        }
-
-        let rebuild_loc_idx = match rebuild_loc_idx {
-            Some(i) => i,
+        let (rebuild_loc_idx, other_dirs) = match select_rebuild_location(&loc_infos) {
+            Some(picked) => picked,
            None => {
                return Ok(Response::new(
                    volume_server_pb::VolumeEcShardsRebuildResponse {
@@ -2545,13 +2583,37 @@ impl VolumeServer for VolumeGrpcService {
        let rebuild_idx_dir = loc_infos[rebuild_loc_idx].idx_dir.clone();

        // Determine data/parity shard config from rebuild dir
-        let (data_shards, parity_shards) =
-            crate::storage::erasure_coding::ec_volume::read_ec_shard_config(
+        // The encode-time .dat size resolves the row count the ecx rebuild
+        // de-stripes with; 0 leaves it to infer from the padded shard extent.
+        // Both lookups search the sibling disks too: the rebuild writes into one
+        // location, but a multi-disk server may keep this volume's .vif or its
+        // generation-0 .ecsum on another, and defaulting to 10+4 with the
+        // legacy layout would reconstruct through the wrong matrix.
+        let dat_file_size = crate::storage::erasure_coding::ec_volume::load_vif_info_across_dirs(
+            &rebuild_dir,
+            &rebuild_idx_dir,
+            &other_dirs,
+            collection,
+            vid,
+        )
+        .ok()
+        .flatten()
+        .map(|(v, _)| v.dat_file_size)
+        .unwrap_or(0);
+        let (data_shards, parity_shards, block_size) =
+            crate::storage::erasure_coding::ec_volume::read_ec_shard_config_across_dirs(
                &rebuild_dir,
                &rebuild_idx_dir,
+                &other_dirs,
                collection,
                vid,
-            );
+            )
+            .map_err(|e| {
+                tonic::Status::internal(format!(
+                    "read ec shard config for volume {}: {}",
+                    vid.0, e
+                ))
+            })?;
        let total_shards = data_shards + parity_shards;

        // Check which shards are missing (check rebuild dir and all other dirs)
@@ -2590,8 +2652,17 @@ impl VolumeServer for VolumeGrpcService {

        // Rebuild missing shards, searching all locations for input shards.
        // Pass other_dirs so shards on sibling disks are found even when the
-        // primary rebuild dir doesn't hold them.
-        let other_dir_refs: Vec<&str> = other_dirs.iter().map(|s| s.as_str()).collect();
+        // primary rebuild dir doesn't hold them. This one takes a single flat
+        // list — the shape Go's RebuildEcFiles uses — so unlike the resolvers
+        // above it cannot be handed the rebuild's own index directory
+        // separately, and a split -dir/-dir.idx location keeps its .ecx and
+        // .vif there. Go's additionalDirs carries that directory for the same
+        // reason.
+        let mut rebuild_search_dirs: Vec<String> = other_dirs.clone();
+        if !rebuild_idx_dir.is_empty() && rebuild_idx_dir != rebuild_dir {
+            rebuild_search_dirs.push(rebuild_idx_dir.clone());
+        }
+        let other_dir_refs: Vec<&str> = rebuild_search_dirs.iter().map(|s| s.as_str()).collect();
        crate::storage::erasure_coding::ec_encoder::rebuild_ec_files(
            &rebuild_dir,
            collection,
@@ -2629,6 +2700,8 @@ impl VolumeServer for VolumeGrpcService {
            collection,
            vid,
            data_shards as usize,
+            block_size,
+            dat_file_size,
            &ecx_dir_refs,
        )
        .map_err(|e| Status::internal(format!("RebuildEcxFile: {}", e)))?;
@@ -3015,6 +3088,27 @@ impl VolumeServer for VolumeGrpcService {
                    Status::internal(format!("mount {}.{}: {}", req.volume_id, shard_id, e))
                })?;
        }
+        // A delivery can bring the checksum manifest alongside the shards, but
+        // the receive path only writes the file. When this server already had
+        // the volume mounted, the EcVolume in memory keeps whatever protection
+        // state it resolved at mount — off, for a volume whose sidecar arrives
+        // now — until a remount. Re-resolve it here, where the shards it
+        // describes have just been added.
+        //
+        // Every per-disk runtime, not just the first: a vid mounts as one
+        // EcVolume per disk, the delivery lands the .ecsum on one of them, and
+        // the first-match lookup would leave the siblings reporting no
+        // protection. Each re-resolves against its own data and index
+        // directories, so a shared -dir.idx reaches all of them.
+        // Resolving across every EC metadata directory is what makes that
+        // reload mean something: startup mirroring gives each shard-bearing
+        // disk its own .ecx/.ecj/.vif but deliberately not the sidecar, so a
+        // runtime restricted to its own two directories would find nothing
+        // however often it reloaded. One delivered copy, reachable from all.
+        let ec_metadata_dirs = store.ec_metadata_dirs();
+        for ec_vol in store.find_all_ec_volumes_mut(vid) {
+            ec_vol.reload_bitrot_sidecar(&ec_metadata_dirs);
+        }
        drop(store);
        self.state.volume_state_notify.notify_one();

@@ -3349,6 +3443,8 @@ impl VolumeServer for VolumeGrpcService {
        let ecx_dir = ec_vol.ecx_actual_dir().to_string();
        let collection = ec_vol.collection.clone();
        let vif_dat_file_size = ec_vol.dat_file_size;
+        let (large_block_size, small_block_size) =
+            (ec_vol.large_block_size(), ec_vol.small_block_size());
        // shard_dirs[i] is guaranteed Some for i in 0..data_shards by
        // the check above; collect concrete dirs for the decoder.
        let per_shard_dirs: Vec<String> = shard_dirs[..data_shards]
@@ -3382,6 +3478,8 @@ impl VolumeServer for VolumeGrpcService {
            vif_dat_file_size,
            data_shards,
            &per_shard_dirs,
+            large_block_size as usize,
+            small_block_size as usize,
        )
        .map_err(|e| Status::internal(format!("WriteDatFile: {}", e)))?;

@@ -3440,12 +3538,24 @@ impl VolumeServer for VolumeGrpcService {
            .walk_ecx_stats()
            .map_err(|e| Status::internal(e.to_string()))?;

+        // The layout this holder serves reads through, as Go reports it: a
+        // coordinator cannot otherwise tell a holder that understands the
+        // uniform block layout from one that dropped the unknown .vif field
+        // and mounted the volume as legacy.
+        let ec_shard_config = Some(volume_server_pb::EcShardConfig {
+            data_shards: ec_vol.data_shards,
+            parity_shards: ec_vol.parity_shards,
+            encode_ts_ns: 0,
+            block_size: ec_vol.block_size,
+        });
+
        Ok(Response::new(
            volume_server_pb::VolumeEcShardsInfoResponse {
                ec_shard_infos: shard_infos,
                volume_size,
                file_count,
                file_deleted_count,
+                ec_shard_config,
            },
        ))
    }
@@ -5086,6 +5196,110 @@ mod tests {
    use tempfile::TempDir;
    use tokio_stream::StreamExt;

+    fn loc(dir: &str, idx_dir: &str, shard_count: usize, has_ecx: bool) -> LocInfo {
+        LocInfo {
+            dir: dir.to_string(),
+            idx_dir: idx_dir.to_string(),
+            shard_count,
+            has_ecx,
+        }
+    }
+
+    // The rebuild reads its shards from one directory but resolves the volume's
+    // layout -- ratio and uniform block size -- from the .vif or the
+    // generation-0 .ecsum, which on a multi-disk server may sit anywhere. Every
+    // directory that could hold one has to be in the search list, or the
+    // resolution silently falls back to 10+4 with the legacy striping and
+    // reconstructs through the wrong matrix.
+    // The rebuild's own data and index directories are handed to the resolvers
+    // as their own arguments, so they are deliberately absent from this list --
+    // unlike Go, whose resolver takes a single directory list and therefore
+    // carries the rebuild's index directory inside it.
+    #[test]
+    fn select_rebuild_location_excludes_the_rebuilds_own_dirs() {
+        for infos in [
+            vec![loc("/data1", "/idx1", 3, true)],
+            vec![loc("/data1", "/data1", 3, true)],
+        ] {
+            let (idx, others) = select_rebuild_location(&infos).expect("a location with .ecx");
+            assert_eq!(idx, 0);
+            assert!(others.is_empty(), "got {:?}", others);
+        }
+    }
+
+    // The case two reviewers flagged: a sibling holding only shards while its
+    // index directory holds this volume's .vif.
+    #[test]
+    fn select_rebuild_location_searches_a_siblings_index_dir_not_just_its_data_dir() {
+        let infos = vec![
+            loc("/data1", "/data1", 5, true),
+            loc("/data2", "/idx2", 2, false),
+        ];
+        let (idx, others) = select_rebuild_location(&infos).expect("a location with .ecx");
+        assert_eq!(idx, 0);
+        assert_eq!(others, vec!["/data2".to_string(), "/idx2".to_string()]);
+    }
+
+    // Several disks pointed at one index directory is a normal -dir.idx
+    // deployment; the shared directory is worth searching but only once.
+    #[test]
+    fn select_rebuild_location_lists_a_shared_index_dir_once() {
+        let infos = vec![
+            loc("/data1", "/data1", 5, true),
+            loc("/data2", "/shared-idx", 2, false),
+            loc("/data3", "/shared-idx", 1, false),
+        ];
+        let (_, others) = select_rebuild_location(&infos).expect("a location with .ecx");
+        assert_eq!(
+            others,
+            vec![
+                "/data2".to_string(),
+                "/data3".to_string(),
+                "/shared-idx".to_string()
+            ]
+        );
+    }
+
+    // When the shared index directory is the rebuild's own it drops out, since
+    // the caller passes it separately.
+    #[test]
+    fn select_rebuild_location_omits_a_shared_index_dir_it_rebuilds_into() {
+        let infos = vec![
+            loc("/data1", "/shared-idx", 5, true),
+            loc("/data2", "/shared-idx", 2, false),
+        ];
+        let (_, others) = select_rebuild_location(&infos).expect("a location with .ecx");
+        assert_eq!(others, vec!["/data2".to_string()]);
+    }
+
+    // The winner moves as a fuller location turns up; the one it displaces
+    // still has to be searched, index directory included.
+    #[test]
+    fn select_rebuild_location_keeps_the_displaced_winners_dirs() {
+        let infos = vec![
+            loc("/data1", "/idx1", 2, true),
+            loc("/data2", "/idx2", 9, true),
+        ];
+        let (idx, others) = select_rebuild_location(&infos).expect("a location with .ecx");
+        assert_eq!(idx, 1, "the fuller location wins");
+        assert_eq!(others, vec!["/data1".to_string(), "/idx1".to_string()]);
+    }
+
+    #[test]
+    fn select_rebuild_location_drops_empty_dirs() {
+        let infos = vec![loc("/data1", "", 3, true), loc("/data2", "", 1, false)];
+        let (_, others) = select_rebuild_location(&infos).expect("a location with .ecx");
+        assert_eq!(others, vec!["/data2".to_string()]);
+    }
+
+    // Nothing carries an .ecx: there is no index to rebuild the shards against,
+    // so the caller answers with an empty rebuild rather than guessing.
+    #[test]
+    fn select_rebuild_location_is_none_without_an_ecx() {
+        let infos = vec![loc("/data1", "/idx1", 3, false)];
+        assert!(select_rebuild_location(&infos).is_none());
+    }
+
    #[test]
    fn test_parse_grpc_address_with_explicit_grpc_port() {
        // Format: "ip:port.grpcPort" — used by SeaweedFS for source_data_node
@@ -599,7 +599,7 @@ fn read_local_intervals(
 ) -> Vec<IntervalResult> {
    let mut interval_results = Vec::with_capacity(intervals.len());
    for interval in intervals {
-        let (shard_id, shard_offset) = interval.to_shard_id_and_offset(ecv.data_shards);
+        let (shard_id, shard_offset) = ecv.interval_to_shard_id_and_offset(interval);
        let buf_size = interval.size as usize;
        let local = ecv.shards.get(shard_id as usize).and_then(|s| s.as_ref());
        match local {
@@ -465,6 +465,28 @@ pub fn resolve_status(
    }
 }

+/// Whether a generation-matching sidecar agrees with the geometry the volume is
+/// mounted with. Both files record the layout the generation was encoded with,
+/// so a disagreement means one of them is wrong and reads through the other
+/// would land at the wrong shard offsets — the caller fails the mount rather
+/// than merely dropping protection. A sidecar that records no EC config has
+/// nothing to contradict.
+pub fn geometry_matches(
+    prot: &EcBitrotProtection,
+    data_shards: usize,
+    parity_shards: usize,
+    block_size: i64,
+) -> bool {
+    match &prot.ec_shard_config {
+        None => true,
+        Some(cfg) => {
+            cfg.data_shards as usize == data_shards
+                && cfg.parity_shards as usize == parity_shards
+                && cfg.block_size == block_size
+        }
+    }
+}
+
 /// Returns the [`EcShardChecksums`] entry for a shard id, or `None`.
 pub fn shard_checksums(prot: &EcBitrotProtection, shard_id: u32) -> Option<&EcShardChecksums> {
    prot.shards.iter().find(|s| s.shard_id == shard_id)
@@ -539,11 +561,12 @@ fn read_full_at(f: &File, buf: &mut [u8], offset: u64) -> io::Result<()> {

 /// Builds the `EcShardConfig` proto for the given layout. The bitrot sidecar
 /// carries its own top-level encode_uuid, so the nested config leaves it empty.
-pub fn ec_shard_config(data_shards: u32, parity_shards: u32) -> EcShardConfig {
+pub fn ec_shard_config(data_shards: u32, parity_shards: u32, block_size: i64) -> EcShardConfig {
    EcShardConfig {
        data_shards,
        parity_shards,
        encode_ts_ns: 0,
+        block_size,
    }
 }

@@ -567,6 +590,7 @@ mod tests {
                data_shards: 10,
                parity_shards: 4,
                encode_ts_ns: 0,
+                block_size: 0,
            }),
            shards: vec![
                EcShardChecksums {
@@ -712,7 +736,7 @@ mod tests {
            algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
            block_size: DEFAULT_BITROT_BLOCK_SIZE as u32,
            generation: 0,
-            ec_shard_config: Some(ec_shard_config(10, 4)),
+            ec_shard_config: Some(ec_shard_config(10, 4, 0)),
            shards: vec![EcShardChecksums {
                shard_id: 0,
                covered_size: covered,
@@ -750,7 +774,7 @@ mod tests {
            algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
            block_size: DEFAULT_BITROT_BLOCK_SIZE as u32,
            generation: 0,
-            ec_shard_config: Some(ec_shard_config(10, 4)),
+            ec_shard_config: Some(ec_shard_config(10, 4, 0)),
            shards: vec![EcShardChecksums {
                shard_id: 0,
                covered_size: 5,
@@ -794,7 +818,7 @@ mod tests {
            algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
            block_size: DEFAULT_BITROT_BLOCK_SIZE as u32,
            generation: 0,
-            ec_shard_config: Some(ec_shard_config(10, 4)),
+            ec_shard_config: Some(ec_shard_config(10, 4, 0)),
            shards,
            encode_uuid: vec![0u8; 16],
        }
@@ -80,6 +80,8 @@ pub fn write_dat_file_from_shards(
    dat_file_size: i64,
    encoded_dat_file_size: i64,
    data_shards: usize,
+    large_block_size: usize,
+    small_block_size: usize,
 ) -> io::Result<()> {
    let dirs: Vec<String> = (0..data_shards).map(|_| dir.to_string()).collect();
    write_dat_file_from_shards_with_dirs(
@@ -90,6 +92,8 @@ pub fn write_dat_file_from_shards(
        encoded_dat_file_size,
        data_shards,
        &dirs,
+        large_block_size,
+        small_block_size,
    )
 }

@@ -113,7 +117,10 @@ pub fn write_dat_file_from_shards(
 /// boundary, and deriving the layout from the shrunk extent would read
 /// the shards in the wrong block order. Pass zero when the .vif does
 /// not record the encode-time size to infer the layout from the shard
-/// size.
+/// size. `large_block_size`/`small_block_size` are the volume's shard
+/// block layout, e.g. `EcVolume::large_block_size()` /
+/// `small_block_size()` from its .vif EC config.
+#[allow(clippy::too_many_arguments)]
 pub fn write_dat_file_from_shards_with_dirs(
    dat_dir: &str,
    collection: &str,
@@ -122,6 +129,8 @@ pub fn write_dat_file_from_shards_with_dirs(
    encoded_dat_file_size: i64,
    data_shards: usize,
    shard_dirs: &[String],
+    large_block_size: usize,
+    small_block_size: usize,
 ) -> io::Result<()> {
    write_dat_file(
        dat_dir,
@@ -131,8 +140,8 @@ pub fn write_dat_file_from_shards_with_dirs(
        encoded_dat_file_size,
        data_shards,
        shard_dirs,
-        ERASURE_CODING_LARGE_BLOCK_SIZE,
-        ERASURE_CODING_SMALL_BLOCK_SIZE,
+        large_block_size,
+        small_block_size,
    )
 }

@@ -412,7 +421,9 @@ mod tests {
        // Encode to EC
        let data_shards = 10;
        let parity_shards = 4;
-        ec_encoder::write_ec_files(dir, dir, "", VolumeId(1), data_shards, parity_shards).unwrap();
+        let block_size =
+            ec_encoder::write_ec_files(dir, dir, "", VolumeId(1), data_shards, parity_shards)
+                .unwrap();

        // Delete original .dat and .idx
        std::fs::remove_file(format!("{}/1.dat", dir)).unwrap();
@@ -426,6 +437,8 @@ mod tests {
            original_dat_size as i64,
            original_dat_size as i64,
            data_shards,
+            block_size as usize,
+            block_size as usize,
        )
        .unwrap();
        write_idx_file_from_ec_index(dir, "", VolumeId(1)).unwrap();
@@ -472,7 +485,16 @@ mod tests {
        let dir = tmp.path().to_str().unwrap();
        // No shard files exist, so de-striping must fail and publish nothing:
        // neither the final .dat nor a partial .dat.tmp may remain.
-        let res = write_dat_file_from_shards(dir, "", VolumeId(7), 100, 100, 10);
+        let res = write_dat_file_from_shards(
+            dir,
+            "",
+            VolumeId(7),
+            100,
+            100,
+            10,
+            ERASURE_CODING_LARGE_BLOCK_SIZE,
+            ERASURE_CODING_SMALL_BLOCK_SIZE,
+        );
        assert!(res.is_err());
        assert!(!std::path::Path::new(&format!("{}/7.dat", dir)).exists());
        assert!(!std::path::Path::new(&format!("{}/7.dat.tmp", dir)).exists());
@@ -525,6 +547,7 @@ mod tests {
                &mut builders,
                data_shards,
                parity_shards,
+                SMALL,
                LARGE,
                SMALL,
            )
@@ -616,6 +639,7 @@ mod tests {
            &mut builders,
            data_shards,
            parity_shards,
+            SMALL,
            LARGE,
            SMALL,
        )
@@ -25,6 +25,10 @@ use crate::storage::volume::volume_file_name;
 ///
 /// Creates .ec00-.ec13 files in the same directory.
 /// Also creates a sorted .ecx index from the .idx file.
+///
+/// Always encodes with the uniform block layout, sized for this .dat, and
+/// returns the block size so the caller can persist it to .vif. Mirrors Go's
+/// WriteEcFiles.
 pub fn write_ec_files(
    dir: &str,
    idx_dir: &str,
@@ -32,7 +36,7 @@ pub fn write_ec_files(
    volume_id: VolumeId,
    data_shards: usize,
    parity_shards: usize,
-) -> io::Result<()> {
+) -> io::Result<i64> {
    let base = volume_file_name(dir, collection, volume_id);
    let dat_path = format!("{}.dat", base);
    let idx_base = volume_file_name(idx_dir, collection, volume_id);
@@ -66,7 +70,7 @@ pub fn write_ec_files(
        .map(|_| ShardChecksumBuilder::new(DEFAULT_BITROT_BLOCK_SIZE as i64))
        .collect();

-    // Encode in large blocks, then small blocks
+    let block_size = uniform_block_size(dat_size, data_shards);
    encode_dat_file(
        &dat_file,
        dat_size,
@@ -75,8 +79,9 @@ pub fn write_ec_files(
        &mut builders,
        data_shards,
        parity_shards,
-        ERASURE_CODING_LARGE_BLOCK_SIZE,
-        ERASURE_CODING_SMALL_BLOCK_SIZE,
+        ENCODE_BUFFER_SIZE,
+        block_size as usize,
+        block_size as usize,
    )?;

    // Close all shards
@@ -103,6 +108,7 @@ pub fn write_ec_files(
        ec_shard_config: Some(ec_bitrot::ec_shard_config(
            data_shards as u32,
            parity_shards as u32,
+            block_size,
        )),
        shards: shard_checksums,
        encode_uuid: ec_bitrot::new_encode_uuid(),
@@ -120,7 +126,19 @@ pub fn write_ec_files(
        );
    }

-    Ok(())
+    Ok(block_size)
+}
+
+/// uniform_block_size returns the per-shard block size of the uniform layout
+/// for a .dat of the given size: ceil(dat_file_size/data_shards) rounded up to
+/// a whole small block. For every input this equals the legacy layout's padded
+/// shard size, so only the byte placement differs between the two layouts,
+/// never the shard length. Mirrors Go's UniformBlockSize.
+pub fn uniform_block_size(dat_file_size: i64, data_shards: usize) -> i64 {
+    let small = ERASURE_CODING_SMALL_BLOCK_SIZE as i64;
+    let per_shard = (dat_file_size + data_shards as i64 - 1) / data_shards as i64;
+    let blocks = ((per_shard + small - 1) / small).max(1);
+    blocks * small
 }

 /// Rebuild missing EC shard files from existing shards using Reed-Solomon reconstruct.
@@ -370,7 +388,7 @@ pub fn verify_ec_shards(
 }

 /// Write sorted .ecx index from .idx file.
-fn write_sorted_ecx_from_idx(idx_path: &str, ecx_path: &str) -> io::Result<()> {
+pub(crate) fn write_sorted_ecx_from_idx(idx_path: &str, ecx_path: &str) -> io::Result<()> {
    if !std::path::Path::new(idx_path).exists() {
        return Err(io::Error::new(
            io::ErrorKind::NotFound,
@@ -421,6 +439,8 @@ pub fn rebuild_ecx_file(
    collection: &str,
    volume_id: VolumeId,
    data_shards: usize,
+    block_size: i64,
+    dat_file_size: i64,
    additional_dirs: &[&str],
 ) -> io::Result<()> {
    use crate::storage::needle::needle::get_actual_size;
@@ -463,10 +483,42 @@ pub fn rebuild_ecx_file(
    // Determine total logical data size from shard sizes
    let shard_size = shards.iter().map(|s| s.file_size()).max().unwrap_or(0);
    let total_data_size = shard_size as i64 * data_shards as i64;
+    // The volume's shard block layout: the .vif-recorded uniform block size,
+    // or the legacy two-tier sizes when 0. The row count comes from the shard
+    // length; -1 disambiguates a legacy shard that is an exact large-block
+    // multiple (mirrors the ecdFileSize-1 fallback in the read path).
+    let (large_block, small_block) = if block_size > 0 {
+        (block_size, block_size)
+    } else {
+        (
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        )
+    };
+    // The row count the de-stripe walks with. The encode-time .dat size is the
+    // authority — the same value the read path divides by data_shards — and the
+    // padded extent is only a fallback: under the legacy layout a shard that is
+    // an exact large-block multiple reads as one row too many, which
+    // re-interprets its last large row as small blocks and scrambles the
+    // recovered offsets. Subtracting one keeps that fallback on the safe side of
+    // the boundary, exactly as the read path's own fallback does.
+    let locate_shard_size = if dat_file_size > 0 {
+        dat_file_size / data_shards as i64
+    } else {
+        (shard_size as i64 - 1).max(0)
+    };

    // Read version from superblock (first byte of logical data)
    let mut sb_buf = [0u8; SUPER_BLOCK_SIZE];
-    read_from_data_shards(&shards, &mut sb_buf, 0, data_shards)?;
+    read_from_data_shards(
+        &shards,
+        &mut sb_buf,
+        0,
+        data_shards,
+        locate_shard_size,
+        large_block,
+        small_block,
+    )?;
    let version = Version(sb_buf[0]);

    // Walk needles starting after superblock
@@ -475,10 +527,30 @@ pub fn rebuild_ecx_file(
    let mut entries: Vec<(NeedleId, Offset, Size)> = Vec::new();

    while offset + header_size as i64 <= total_data_size {
-        // Read needle header (cookie + needle_id + size = 16 bytes)
+        // Read needle header (cookie + needle_id + size = 16 bytes).
+        // A read failure is NOT the end of the data — every offset in
+        // range maps into the shards, so an error means a truncated or
+        // unreadable shard. Publishing the entries collected so far as
+        // a successful .ecx would hand out a silently incomplete
+        // recovery index; propagate instead. (The scan still ends
+        // normally on the zero-cookie tail below.)
        let mut header_buf = [0u8; NEEDLE_HEADER_SIZE];
-        if read_from_data_shards(&shards, &mut header_buf, offset as u64, data_shards).is_err() {
-            break;
+        if let Err(e) = read_from_data_shards(
+            &shards,
+            &mut header_buf,
+            offset as u64,
+            data_shards,
+            locate_shard_size,
+            large_block,
+            small_block,
+        ) {
+            for s in &mut shards {
+                s.close();
+            }
+            return Err(io::Error::new(
+                e.kind(),
+                format!("scan needle header at offset {}: {}", offset, e),
+            ));
        }

        let cookie = Cookie::from_bytes(&header_buf[..COOKIE_SIZE]);
@@ -532,58 +604,83 @@ pub fn rebuild_ecx_file(
    Ok(())
 }

-/// Read bytes from EC data shards at a logical offset in the .dat file.
+/// Read bytes from EC data shards at a logical offset in the .dat file,
+/// resolving the shard/offset through the volume's block layout via
+/// locate_data — the same mapping the read path uses.
+#[allow(clippy::too_many_arguments)]
 fn read_from_data_shards(
    shards: &[EcVolumeShard],
    buf: &mut [u8],
    logical_offset: u64,
    data_shards: usize,
+    locate_shard_size: i64,
+    large_block_size: i64,
+    small_block_size: i64,
 ) -> io::Result<()> {
-    let small_block = ERASURE_CODING_SMALL_BLOCK_SIZE as u64;
-    let data_shards_u64 = data_shards as u64;
-
-    let mut bytes_read = 0u64;
-    let mut remaining = buf.len() as u64;
-    let mut current_offset = logical_offset;
-
-    while remaining > 0 {
-        // Determine which shard and at what shard-offset this logical offset maps to.
-        // The data is interleaved: large blocks first, then small blocks.
-        // For simplicity, use the small block size for all calculations since
-        // large blocks are multiples of small blocks.
-        let row_size = small_block * data_shards_u64;
-        let row_index = current_offset / row_size;
-        let row_offset = current_offset % row_size;
-        let shard_index = (row_offset / small_block) as usize;
-        let shard_offset = row_index * small_block + (row_offset % small_block);
-
-        if shard_index >= data_shards {
+    let intervals = crate::storage::erasure_coding::ec_locate::locate_data(
+        logical_offset as i64,
+        Size(buf.len() as i32),
+        locate_shard_size,
+        data_shards as u32,
+        large_block_size,
+        small_block_size,
+    );
+    let mut bytes_read = 0usize;
+    for interval in &intervals {
+        let (shard_id, shard_offset) =
+            interval.to_shard_id_and_offset(data_shards as u32, large_block_size, small_block_size);
+        if shard_id as usize >= data_shards {
            return Err(io::Error::new(
                io::ErrorKind::InvalidInput,
                "shard index out of range",
            ));
        }
-
-        // How many bytes can we read from this position in this shard block
-        let bytes_left_in_block = small_block - (row_offset % small_block);
-        let to_read = remaining.min(bytes_left_in_block) as usize;
-
-        let dest = &mut buf[bytes_read as usize..bytes_read as usize + to_read];
-        shards[shard_index].read_at(dest, shard_offset)?;
-
-        bytes_read += to_read as u64;
-        remaining -= to_read as u64;
-        current_offset += to_read as u64;
+        let to_read = interval.size as usize;
+        let dest = &mut buf[bytes_read..bytes_read + to_read];
+        // Exact-read semantics: read_at may legally return fewer bytes
+        // than requested, and treating a short read as complete leaves
+        // the tail of `dest` as whatever the buffer held before. Loop
+        // until filled; zero bytes inside the mapped range means the
+        // shard is truncated — an error, not an end.
+        let mut filled = 0usize;
+        while filled < to_read {
+            let n = shards[shard_id as usize]
+                .read_at(&mut dest[filled..], shard_offset as u64 + filled as u64)?;
+            if n == 0 {
+                return Err(io::Error::new(
+                    io::ErrorKind::UnexpectedEof,
+                    format!(
+                        "short read from data shard {}: {} of {} bytes at offset {}",
+                        shard_id, filled, to_read, shard_offset
+                    ),
+                ));
+            }
+            filled += n;
+        }
+        bytes_read += to_read;
+    }
+    if bytes_read != buf.len() {
+        return Err(io::Error::new(
+            io::ErrorKind::UnexpectedEof,
+            "short read from data shards",
+        ));
    }
-
    Ok(())
 }

+/// Buffer size for one encode sub-batch per shard, mirroring Go's 256KB
+/// bufferSize in WriteEcFiles. A block is processed in block_size/buffer_size
+/// sub-batches, so memory stays at total_shards * 256KB no matter how large
+/// the uniform block is.
+const ENCODE_BUFFER_SIZE: usize = 256 * 1024;
+
 /// Encode the .dat file data into shard files.
 ///
 /// Uses a two-phase approach matching Go's ec_encoder.go:
-/// 1. Process as many large blocks (1GB) as possible
-/// 2. Process remaining data with small blocks (1MB)
+/// 1. Process as many large blocks as possible
+/// 2. Process remaining data with small blocks
+///
+/// `buffer_size` must divide both block sizes.
 #[allow(clippy::too_many_arguments)]
 pub(crate) fn encode_dat_file(
    dat_file: &File,
@@ -593,44 +690,50 @@ pub(crate) fn encode_dat_file(
    builders: &mut [ShardChecksumBuilder],
    data_shards: usize,
    parity_shards: usize,
+    buffer_size: usize,
    large_block_size: usize,
    small_block_size: usize,
 ) -> io::Result<()> {
+    let total_shards = data_shards + parity_shards;
+    let mut buffers: Vec<Vec<u8>> = (0..total_shards)
+        .map(|_| vec![0u8; buffer_size])
+        .collect();
+
    let mut remaining = dat_size;
    let mut offset: u64 = 0;

-    // Phase 1: Process large blocks (1GB each) while enough data remains
+    // Phase 1: process whole large-block rows while enough data remains
    let large_row_size = large_block_size * data_shards;

    while remaining >= large_row_size as i64 {
-        encode_one_batch(
+        encode_data(
            dat_file,
            offset,
            large_block_size,
            rs,
+            &mut buffers,
            shards,
            builders,
            data_shards,
-            parity_shards,
        )?;
        offset += large_row_size as u64;
        remaining -= large_row_size as i64;
    }

-    // Phase 2: Process remaining data with small blocks (1MB each)
+    // Phase 2: process remaining data with small blocks
    let small_row_size = small_block_size * data_shards;

    while remaining > 0 {
        let to_process = remaining.min(small_row_size as i64);
-        encode_one_batch(
+        encode_data(
            dat_file,
            offset,
            small_block_size,
            rs,
+            &mut buffers,
            shards,
            builders,
            data_shards,
-            parity_shards,
        )?;
        offset += to_process as u64;
        remaining -= to_process;
@@ -639,61 +742,71 @@ pub(crate) fn encode_dat_file(
    Ok(())
 }

-/// Encode one batch (row) of data.
+/// Encode one row of blocks, streaming it in ENCODE_BUFFER_SIZE sub-batches so
+/// arbitrarily large blocks never require block-sized allocations. Mirrors
+/// Go's encodeData.
+#[allow(clippy::too_many_arguments)]
+fn encode_data(
+    dat_file: &File,
+    row_offset: u64,
+    block_size: usize,
+    rs: &ReedSolomon,
+    buffers: &mut [Vec<u8>],
+    shards: &mut [EcVolumeShard],
+    builders: &mut [ShardChecksumBuilder],
+    data_shards: usize,
+) -> io::Result<()> {
+    let buffer_size = buffers[0].len();
+    if block_size % buffer_size != 0 {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!(
+                "unexpected block size {} buffer size {}",
+                block_size, buffer_size
+            ),
+        ));
+    }
+    let batch_count = block_size / buffer_size;
+    for b in 0..batch_count {
+        encode_one_batch(
+            dat_file,
+            row_offset + (b * buffer_size) as u64,
+            block_size,
+            rs,
+            buffers,
+            shards,
+            builders,
+            data_shards,
+        )?;
+    }
+    Ok(())
+}
+
+/// Encode one sub-batch: the same buffer-sized slice of every shard's block in
+/// this row. Mirrors Go's encodeDataOneBatch.
+#[allow(clippy::too_many_arguments)]
 fn encode_one_batch(
    dat_file: &File,
    offset: u64,
    block_size: usize,
    rs: &ReedSolomon,
+    buffers: &mut [Vec<u8>],
    shards: &mut [EcVolumeShard],
    builders: &mut [ShardChecksumBuilder],
    data_shards: usize,
-    parity_shards: usize,
 ) -> io::Result<()> {
-    let total_shards = data_shards + parity_shards;
-    // Each batch allocates block_size * total_shards bytes.
-    // With large blocks (1 GiB) this is 14 GiB -- guard against OOM.
-    let total_alloc = block_size.checked_mul(total_shards).ok_or_else(|| {
-        io::Error::new(
-            io::ErrorKind::InvalidInput,
-            "block_size * shard count overflows usize",
-        )
-    })?;
-    // Large-block encoding uses 1 GiB * 14 shards = 14 GiB; allow up to 16 GiB.
-    const MAX_BATCH_ALLOC: usize = 16 * 1024 * 1024 * 1024; // 16 GiB safety limit
-    if total_alloc > MAX_BATCH_ALLOC {
-        return Err(io::Error::new(
-            io::ErrorKind::InvalidInput,
-            format!(
-                "batch allocation too large ({} bytes, limit {} bytes); block_size={} shards={}",
-                total_alloc, MAX_BATCH_ALLOC, block_size, total_shards,
-            ),
-        ));
-    }
-
-    // Allocate buffers for all shards
-    let mut buffers: Vec<Vec<u8>> = (0..total_shards).map(|_| vec![0u8; block_size]).collect();
-
-    // Read data shards from .dat file
+    // Read data shards from the .dat file, zero-filling past EOF — the buffers
+    // are reused across batches, so the tail must be cleared explicitly.
    for i in 0..data_shards {
        let read_offset = offset + (i * block_size) as u64;
-
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::FileExt;
-            dat_file.read_at(&mut buffers[i], read_offset)?;
-        }
-
-        #[cfg(not(unix))]
-        {
-            let mut f = dat_file.try_clone()?;
-            f.seek(SeekFrom::Start(read_offset))?;
-            f.read(&mut buffers[i])?;
+        let n = read_at_most(dat_file, &mut buffers[i], read_offset)?;
+        for b in buffers[i][n..].iter_mut() {
+            *b = 0;
        }
    }

    // Encode parity shards
-    rs.encode(&mut buffers).map_err(|e| {
+    rs.encode(&mut *buffers).map_err(|e| {
        io::Error::new(
            io::ErrorKind::Other,
            format!("reed-solomon encode: {:?}", e),
@@ -710,6 +823,29 @@ fn encode_one_batch(
    Ok(())
 }

+/// Read into `buf` at `offset` until it is full or EOF; returns bytes read.
+fn read_at_most(dat_file: &File, buf: &mut [u8], offset: u64) -> io::Result<usize> {
+    let mut n = 0;
+    while n < buf.len() {
+        #[cfg(unix)]
+        let r = {
+            use std::os::unix::fs::FileExt;
+            dat_file.read_at(&mut buf[n..], offset + n as u64)?
+        };
+        #[cfg(not(unix))]
+        let r = {
+            let mut f = dat_file.try_clone()?;
+            f.seek(SeekFrom::Start(offset + n as u64))?;
+            f.read(&mut buf[n..])?
+        };
+        if r == 0 {
+            break;
+        }
+        n += r;
+    }
+    Ok(n)
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -1020,7 +1156,7 @@ mod tests {

        // Without additional_dirs, rebuild must fail: shards 1, 3, 6 are not
        // in primary and the full logical .dat content can't be reconstructed.
-        let res = rebuild_ecx_file(&primary, "", VolumeId(1), 10, &[]);
+        let res = rebuild_ecx_file(&primary, "", VolumeId(1), 10, 0, 0, &[]);
        assert!(
            res.is_err(),
            "ecx rebuild without additional_dirs must fail when data shards are on another disk"
@@ -1031,7 +1167,7 @@ mod tests {
        );

        // With additional_dirs pointing at the secondary, the rebuild must succeed.
-        rebuild_ecx_file(&primary, "", VolumeId(1), 10, &[secondary.as_str()]).unwrap();
+        rebuild_ecx_file(&primary, "", VolumeId(1), 10, 0, 0, &[secondary.as_str()]).unwrap();

        assert!(
            std::path::Path::new(&ecx_path).exists(),
@@ -1043,6 +1179,118 @@ mod tests {
        );
    }

+    // A uniform-layout volume (block size > 1MiB) must have its .ecx rebuilt
+    // through the recorded geometry; the legacy 1MiB mapping would scan
+    // garbage past the first block boundary.
+    #[test]
+    fn test_rebuild_ecx_file_uniform_layout() {
+        use crate::storage::needle_map::NeedleMapKind;
+        use crate::storage::volume::Volume;
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap().to_string();
+        let mut v = Volume::new(
+            &dir,
+            &dir,
+            "",
+            VolumeId(2),
+            NeedleMapKind::InMemory,
+            None,
+            None,
+            0,
+            Version::current(),
+        )
+        .unwrap();
+        for i in 1u64..=12 {
+            let data: Vec<u8> = (0..2 << 20)
+                .map(|b| ((b as u64).wrapping_mul(2654435761).wrapping_add(i) >> 8) as u8)
+                .collect();
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(i as u32),
+                data: data.clone(),
+                data_size: data.len() as u32,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+        }
+        v.sync_to_disk().unwrap();
+        v.close();
+        let block_size = write_ec_files(&dir, &dir, "", VolumeId(2), 10, 4).unwrap();
+        assert!(
+            block_size > ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+            "fixture must diverge from the legacy layout"
+        );
+
+        let ecx_path = format!("{}/2.ecx", dir);
+        let canonical = std::fs::read(&ecx_path).unwrap();
+        std::fs::remove_file(&ecx_path).unwrap();
+
+        rebuild_ecx_file(&dir, "", VolumeId(2), 10, block_size, 0, &[]).unwrap();
+        let rebuilt = std::fs::read(&ecx_path).unwrap();
+        assert_eq!(canonical, rebuilt, "rebuilt .ecx must match the encode-time .ecx");
+    }
+
+    // A truncated data shard must FAIL the .ecx rebuild, not publish the
+    // entries scanned so far as a successful (silently incomplete) index.
+    #[test]
+    fn test_rebuild_ecx_file_fails_on_truncated_shard() {
+        use crate::storage::needle_map::NeedleMapKind;
+        use crate::storage::volume::Volume;
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap().to_string();
+        let mut v = Volume::new(
+            &dir,
+            &dir,
+            "",
+            VolumeId(3),
+            NeedleMapKind::InMemory,
+            None,
+            None,
+            0,
+            Version::current(),
+        )
+        .unwrap();
+        for i in 1u64..=12 {
+            let data: Vec<u8> = (0..2 << 20)
+                .map(|b| ((b as u64).wrapping_mul(2654435761).wrapping_add(i) >> 8) as u8)
+                .collect();
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(i as u32),
+                data: data.clone(),
+                data_size: data.len() as u32,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+        }
+        v.sync_to_disk().unwrap();
+        v.close();
+        let block_size = write_ec_files(&dir, &dir, "", VolumeId(3), 10, 4).unwrap();
+
+        let ecx_path = format!("{}/3.ecx", dir);
+        std::fs::remove_file(&ecx_path).unwrap();
+
+        // Truncate shard 0 to just the superblock: the scan's very first
+        // needle-header read (offset SUPER_BLOCK_SIZE, shard 0 under the
+        // uniform layout) lands in the missing region. The pre-fix code
+        // broke the scan there and published an EMPTY .ecx as success.
+        let shard_path = format!("{}/3.ec00", dir);
+        let f = std::fs::OpenOptions::new()
+            .write(true)
+            .open(&shard_path)
+            .unwrap();
+        f.set_len(crate::storage::super_block::SUPER_BLOCK_SIZE as u64)
+            .unwrap();
+        drop(f);
+
+        let res = rebuild_ecx_file(&dir, "", VolumeId(3), 10, block_size, 0, &[]);
+        assert!(res.is_err(), "rebuild over a truncated shard must fail");
+        assert!(
+            !std::path::Path::new(&ecx_path).exists(),
+            "a failed rebuild must not leave a partial .ecx behind"
+        );
+    }
+
    #[test]
    fn test_reed_solomon_basic() {
        let data_shards = 10;
@@ -18,21 +18,26 @@ pub struct Interval {
 }

 impl Interval {
-    pub fn to_shard_id_and_offset(&self, data_shards: u32) -> (ShardId, i64) {
+    pub fn to_shard_id_and_offset(
+        &self,
+        data_shards: u32,
+        large_block_size: i64,
+        small_block_size: i64,
+    ) -> (ShardId, i64) {
        let data_shards_usize = data_shards as usize;
        let shard_id = (self.block_index % data_shards_usize) as ShardId;
        let row_index = self.block_index / data_shards_usize;

        let block_size = if self.is_large_block {
-            ERASURE_CODING_LARGE_BLOCK_SIZE as i64
+            large_block_size
        } else {
-            ERASURE_CODING_SMALL_BLOCK_SIZE as i64
+            small_block_size
        };

        let mut offset = row_index as i64 * block_size + self.inner_block_offset;
        if !self.is_large_block {
            // Small blocks come after large blocks in the shard file
-            offset += self.large_block_rows_count as i64 * ERASURE_CODING_LARGE_BLOCK_SIZE as i64;
+            offset += self.large_block_rows_count as i64 * large_block_size;
        }

        (shard_id, offset)
@@ -42,7 +47,14 @@ impl Interval {
 /// Locate the EC shard intervals needed to read data at the given offset and size.
 ///
 /// `shard_size` is the size of a single shard file.
-pub fn locate_data(offset: i64, size: Size, shard_size: i64, data_shards: u32) -> Vec<Interval> {
+pub fn locate_data(
+    offset: i64,
+    size: Size,
+    shard_size: i64,
+    data_shards: u32,
+    large_block_size: i64,
+    small_block_size: i64,
+) -> Vec<Interval> {
    let mut intervals = Vec::new();
    let data_size = size.0 as i64;

@@ -50,17 +62,14 @@ pub fn locate_data(offset: i64, size: Size, shard_size: i64, data_shards: u32) -
        return intervals;
    }

-    let large_block_size = ERASURE_CODING_LARGE_BLOCK_SIZE as i64;
-    let small_block_size = ERASURE_CODING_SMALL_BLOCK_SIZE as i64;
    let large_row_size = large_block_size * data_shards as i64;
    let small_row_size = small_block_size * data_shards as i64;

-    // Number of large block rows
-    let n_large_block_rows = if shard_size > 0 {
-        ((shard_size - 1) / large_block_size) as usize
-    } else {
-        0
-    };
+    // Number of large block rows. Mirrors Go's shardDatSize/largeBlockLength:
+    // the caller's ecd-size fallback already subtracts 1 to disambiguate the
+    // exact-multiple case, so no further -1 here — a shard size that IS an
+    // exact multiple (dat_file_size path) means real full large rows.
+    let n_large_block_rows = (shard_size / large_block_size) as usize;
    let large_section_size = n_large_block_rows as i64 * large_row_size;

    let mut remaining_offset = offset;
@@ -150,7 +159,11 @@ mod tests {
            is_large_block: true,
            large_block_rows_count: 1,
        };
-        let (shard_id, offset) = interval.to_shard_id_and_offset(data_shards);
+        let (shard_id, offset) = interval.to_shard_id_and_offset(
+            data_shards,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
        assert_eq!(shard_id, 0);
        assert_eq!(offset, 100);

@@ -162,7 +175,11 @@ mod tests {
            is_large_block: true,
            large_block_rows_count: 1,
        };
-        let (shard_id, _offset) = interval.to_shard_id_and_offset(data_shards);
+        let (shard_id, _offset) = interval.to_shard_id_and_offset(
+            data_shards,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
        assert_eq!(shard_id, 5);

        // Block index 12 (data_shards=10) → row_index 1, shard_id 2
@@ -173,7 +190,11 @@ mod tests {
            is_large_block: true,
            large_block_rows_count: 5,
        };
-        let (shard_id, offset) = interval.to_shard_id_and_offset(data_shards);
+        let (shard_id, offset) = interval.to_shard_id_and_offset(
+            data_shards,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
        assert_eq!(shard_id, 2); // 12 % 10 = 2
        assert_eq!(offset, large_block_size + 200); // row 1 offset + inner_block_offset

@@ -185,7 +206,11 @@ mod tests {
            is_large_block: true,
            large_block_rows_count: 2,
        };
-        let (shard_id, offset) = interval.to_shard_id_and_offset(data_shards);
+        let (shard_id, offset) = interval.to_shard_id_and_offset(
+            data_shards,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
        assert_eq!(shard_id, 0);
        assert_eq!(offset, ERASURE_CODING_LARGE_BLOCK_SIZE as i64); // row 1 offset
    }
@@ -193,7 +218,14 @@ mod tests {
    #[test]
    fn test_locate_data_small_file() {
        // Small file: 100 bytes at offset 50, shard size = 1MB
-        let intervals = locate_data(50, Size(100), 1024 * 1024, 10);
+        let intervals = locate_data(
+            50,
+            Size(100),
+            1024 * 1024,
+            10,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
        assert!(!intervals.is_empty());

        // Should be a single small block interval (no large block rows for 1MB shard)
@@ -203,7 +235,14 @@ mod tests {

    #[test]
    fn test_locate_data_empty() {
-        let intervals = locate_data(0, Size(0), 1024 * 1024, 10);
+        let intervals = locate_data(
+            0,
+            Size(0),
+            1024 * 1024,
+            10,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
        assert!(intervals.is_empty());
    }

@@ -216,7 +255,11 @@ mod tests {
            is_large_block: false,
            large_block_rows_count: 2,
        };
-        let (_shard_id, offset) = interval.to_shard_id_and_offset(10);
+        let (_shard_id, offset) = interval.to_shard_id_and_offset(
+            10,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
        // Should be after 2 large block rows
        assert_eq!(offset, 2 * ERASURE_CODING_LARGE_BLOCK_SIZE as i64);
    }
@@ -26,6 +26,9 @@ pub struct EcVolume {
    pub dat_file_size: i64,
    pub data_shards: u32,
    pub parity_shards: u32,
+    /// Uniform block layout: each shard is one contiguous block of this many
+    /// bytes. 0 = legacy 1GiB/1MiB two-tier layout. Loaded from .vif.
+    pub block_size: i64,
    ecx_file: Option<File>,
    ecx_file_size: i64,
    ecj_file: Option<File>,
@@ -101,34 +104,249 @@ fn locate_vif_path(dir: &str, dir_idx: &str, collection: &str, volume_id: Volume
    data_vif
 }

-/// Read EC data/parity shard counts from `.vif`, defaulting to the
-/// build's standard ratio when no `.vif` is present or is malformed.
+/// Load the volume's `.vif` (data dir first, then idx dir, then the active
+/// generation's versioned sidecar — see [`locate_vif_path`]). Absent
+/// everywhere is legal — legacy volumes predate the sidecar — and returns
+/// `None`; so does a zero-byte stub (an ec.decode copy from a source
+/// without one), mirroring Go's MaybeLoadVolumeInfo. A
+/// present-but-unreadable or malformed `.vif` is an ERROR: silently
+/// defaulting would mount a uniform-layout volume with legacy offset math
+/// and serve wrong bytes with a straight face.
+pub fn load_vif_info(
+    dir: &str,
+    dir_idx: &str,
+    collection: &str,
+    volume_id: VolumeId,
+) -> io::Result<Option<crate::storage::volume::VifVolumeInfo>> {
+    let vif_path = locate_vif_path(dir, dir_idx, collection, volume_id);
+    match std::fs::read_to_string(&vif_path) {
+        Ok(content) if content.trim().is_empty() => Ok(None),
+        Ok(content) => serde_json::from_str(&content).map(Some).map_err(|e| {
+            io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!("parse {}: {}", vif_path, e),
+            )
+        }),
+        Err(e) if e.kind() == io::ErrorKind::NotFound => Ok(None),
+        Err(e) => Err(io::Error::new(
+            e.kind(),
+            format!("read {}: {}", vif_path, e),
+        )),
+    }
+}
+
+/// Read the EC data/parity shard counts and shard block size from `.vif`,
+/// defaulting to the build's standard ratio and the legacy block layout when
+/// no `.vif` is present. A present-but-unreadable or malformed `.vif`
+/// fails instead of defaulting (see [`load_vif_info`]).
 /// Looks at the data dir first, then the idx dir — see [`locate_vif_path`].
 pub fn read_ec_shard_config(
    dir: &str,
    dir_idx: &str,
    collection: &str,
    volume_id: VolumeId,
-) -> (u32, u32) {
-    let mut data_shards = crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT as u32;
-    let mut parity_shards = crate::storage::erasure_coding::ec_shard::PARITY_SHARDS_COUNT as u32;
-    let vif_path = locate_vif_path(dir, dir_idx, collection, volume_id);
-    if let Ok(vif_content) = std::fs::read_to_string(&vif_path) {
-        if let Ok(vif_info) =
-            serde_json::from_str::<crate::storage::volume::VifVolumeInfo>(&vif_content)
-        {
-            if let Some(ec) = vif_info.ec_shard_config {
-                if ec.data_shards > 0
-                    && ec.parity_shards > 0
-                    && (ec.data_shards + ec.parity_shards) <= MAX_SHARD_COUNT as u32
-                {
-                    data_shards = ec.data_shards;
-                    parity_shards = ec.parity_shards;
-                }
+) -> io::Result<(u32, u32, i64)> {
+    let vif = load_vif_info(dir, dir_idx, collection, volume_id)?;
+    ec_shard_config_from(vif.as_ref(), &[dir, dir_idx], collection, volume_id)
+}
+
+/// Load the volume's `.vif` from the selected location or, failing that, from
+/// any sibling disk — returning the directory it came from so the caller can
+/// resolve the rest of the volume's metadata against the same place. A rebuild
+/// picks one disk to write into, but a multi-disk server may hold that
+/// volume's metadata on another.
+pub fn load_vif_info_across_dirs(
+    dir: &str,
+    dir_idx: &str,
+    other_dirs: &[String],
+    collection: &str,
+    volume_id: VolumeId,
+) -> io::Result<Option<(crate::storage::volume::VifVolumeInfo, String)>> {
+    if let Some(vif) = load_vif_info(dir, dir_idx, collection, volume_id)? {
+        // Report where it actually came from. load_vif_info probes the data
+        // directory then the index directory, so naming `dir` unconditionally
+        // pointed callers at the wrong disk whenever the vif lived with the
+        // index — and a caller resolving the rest of the volume's metadata
+        // against that answer would look in a directory holding none of it.
+        let data_vif = format!(
+            "{}.vif",
+            crate::storage::volume::volume_file_name(dir, collection, volume_id)
+        );
+        let found_in = if std::path::Path::new(&data_vif).exists() {
+            dir.to_string()
+        } else {
+            dir_idx.to_string()
+        };
+        return Ok(Some((vif, found_in)));
+    }
+    for other in other_dirs {
+        if let Some(vif) = load_vif_info(other, other, collection, volume_id)? {
+            return Ok(Some((vif, other.clone())));
+        }
+    }
+    Ok(None)
+}
+
+/// [`read_ec_shard_config`] for a caller that may find the volume's metadata on
+/// any of the server's disks. Without this a rebuild that lands on a disk
+/// holding only shards reads the default 10+4 and the legacy block layout,
+/// then reconstructs a custom-ratio or uniform volume through the wrong matrix
+/// and de-striping geometry.
+pub fn read_ec_shard_config_across_dirs(
+    dir: &str,
+    dir_idx: &str,
+    other_dirs: &[String],
+    collection: &str,
+    volume_id: VolumeId,
+) -> io::Result<(u32, u32, i64)> {
+    // Every directory this volume's metadata could be in. A split -dir/-dir.idx
+    // location keeps .vif and .ecsum with the INDEX, and callers exclude their
+    // own index directory from other_dirs on the understanding that it is
+    // passed here separately — so it is chained explicitly, exactly as the .vif
+    // lookup and Go's findBitrotSidecar both do.
+    let mut candidates: Vec<&str> = Vec::with_capacity(2 + other_dirs.len());
+    candidates.push(dir);
+    if !dir_idx.is_empty() && dir_idx != dir {
+        candidates.push(dir_idx);
+    }
+    candidates.extend(other_dirs.iter().map(|s| s.as_str()));
+
+    // A vif that carries no ecShardConfig answers nothing about the layout, so
+    // it must NOT short-circuit the sidecar search: a legacy config-free vif
+    // and the generation-0 sidecar can sit in different directories, and
+    // stopping at the vif resolved a 12+4 uniform volume as 10+4 legacy. Pass
+    // the whole candidate list so the fallback covers the same ground the vif
+    // lookup did.
+    let vif = load_vif_info_across_dirs(dir, dir_idx, other_dirs, collection, volume_id)?;
+    ec_shard_config_from(
+        vif.as_ref().map(|(v, _)| v),
+        &candidates,
+        collection,
+        volume_id,
+    )
+}
+
+/// Resolve (data_shards, parity_shards, block_size) from an already-loaded
+/// `.vif`. With no vif — or one carrying no EC config — the bitrot sidecar
+/// records the same config at encode time and answers the layout question the
+/// vif cannot: defaulting a uniform-layout volume to the legacy block sizes
+/// maps every read to the wrong shard offset. `weed fix -ecx` reads the
+/// sidecar for the same reason. Absent both, the build's standard ratio and
+/// the legacy layout.
+pub fn ec_shard_config_from(
+    vif: Option<&crate::storage::volume::VifVolumeInfo>,
+    dirs: &[&str],
+    collection: &str,
+    volume_id: VolumeId,
+) -> io::Result<(u32, u32, i64)> {
+    let default_ds = crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT as u32;
+    let default_ps = crate::storage::erasure_coding::ec_shard::PARITY_SHARDS_COUNT as u32;
+    // Sum as u64: counts near the u32 ceiling would wrap and pass the bound.
+    let usable = |ds: u32, ps: u32| {
+        ds > 0 && ps > 0 && (ds as u64 + ps as u64) <= MAX_SHARD_COUNT as u64
+    };
+
+    if let Some(ec) = vif.and_then(|v| v.ec_shard_config.as_ref()) {
+        // A config that is PRESENT but records an impossible ratio is not a
+        // volume to fall back on: dropping through to the sidecar or the
+        // defaults would read uniform shards with the legacy offset math and
+        // answer with the wrong bytes. Only an ENTIRELY absent config means
+        // "this predates the record".
+        if !usable(ec.data_shards, ec.parity_shards) {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!(
+                    "vif for volume {} records invalid shard counts {}+{}",
+                    volume_id.0, ec.data_shards, ec.parity_shards
+                ),
+            ));
+        }
+        // A recorded block size that no encoder could have produced maps
+        // every read to the wrong shard offset. Refuse the mount rather
+        // than serve those bytes or silently pick a layout.
+        validate_block_size(ec.block_size)?;
+        return Ok((ec.data_shards, ec.parity_shards, ec.block_size));
+    }
+    // With no usable vif config the sidecar is the ONLY record of this volume's
+    // layout, so the three answers stay distinct: absent EVERYWHERE means the
+    // volume may genuinely predate the sidecar and legacy is the right guess;
+    // present-but-unusable means the record is corrupt, and answering reads
+    // from a guessed layout returns wrong bytes rather than none.
+    //
+    // Every candidate directory is searched, not just the first: a split
+    // -dir/-dir.idx location keeps the sidecar with the INDEX, and a multi-disk
+    // server may keep it on a sibling. Stopping at the data directory resolved
+    // a 12+4 uniform volume as 10+4 legacy.
+    let mut path = String::new();
+    for candidate in dirs.iter().filter(|d| !d.is_empty()) {
+        let base = crate::storage::volume::volume_file_name(candidate, collection, volume_id);
+        let probe = crate::storage::erasure_coding::ec_bitrot::bitrot_sidecar_path(&base, 0);
+        match std::fs::metadata(&probe) {
+            Err(e) if e.kind() == io::ErrorKind::NotFound => continue,
+            Err(e) => {
+                return Err(io::Error::new(e.kind(), format!("stat {}: {}", probe, e)));
+            }
+            Ok(_) => {
+                path = probe;
+                break;
            }
        }
    }
-    (data_shards, parity_shards)
+    if path.is_empty() {
+        return Ok((default_ds, default_ps, 0));
+    }
+    let prot = crate::storage::erasure_coding::ec_bitrot::load_bitrot_sidecar(&path)
+        .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, format!("read {}: {}", path, e)))?;
+    // The un-suffixed sidecar describes generation 0 and nothing else.
+    if prot.generation != 0 {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("{} records generation {}, not generation 0", path, prot.generation),
+        ));
+    }
+    let ec = prot.ec_shard_config.as_ref().ok_or_else(|| {
+        io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("{} records no EC config", path),
+        )
+    })?;
+    if !usable(ec.data_shards, ec.parity_shards) {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!(
+                "{} records invalid shard counts {}+{}",
+                path, ec.data_shards, ec.parity_shards
+            ),
+        ));
+    }
+    validate_block_size(ec.block_size)
+        .map_err(|e| io::Error::new(e.kind(), format!("{}: {}", path, e)))?;
+    Ok((ec.data_shards, ec.parity_shards, ec.block_size))
+}
+
+/// Reports whether a `.vif`-recorded shard block size is one an encoder could
+/// have produced. 0 means the legacy two-tier layout, which is always valid;
+/// anything positive must be a whole number of small blocks, because that is
+/// what `uniform_block_size` rounds to. Mirrors Go's `ValidateBlockSize`.
+pub fn validate_block_size(block_size: i64) -> io::Result<()> {
+    if block_size == 0 {
+        return Ok(());
+    }
+    if block_size < 0
+        || block_size
+            % crate::storage::erasure_coding::ec_shard::ERASURE_CODING_SMALL_BLOCK_SIZE as i64
+            != 0
+    {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!(
+                "invalid shard block size {}: expected 0 (legacy) or a multiple of {}",
+                block_size,
+                crate::storage::erasure_coding::ec_shard::ERASURE_CODING_SMALL_BLOCK_SIZE
+            ),
+        ));
+    }
+    Ok(())
 }

 impl EcVolume {
@@ -139,7 +357,14 @@ impl EcVolume {
        collection: &str,
        volume_id: VolumeId,
    ) -> io::Result<Self> {
-        let (data_shards, parity_shards) = read_ec_shard_config(dir, dir_idx, collection, volume_id);
+        // One load of the volume's `.vif`, used for both the shard config and
+        // the version / dat-size fields below.
+        let vif = load_vif_info(dir, dir_idx, collection, volume_id)?;
+        // Both directories: a split -dir/-dir.idx layout keeps the .ecsum with
+        // the INDEX, and it is the only layout record a volume whose vif is
+        // absent or config-free still has.
+        let (data_shards, parity_shards, block_size) =
+            ec_shard_config_from(vif.as_ref(), &[dir, dir_idx], collection, volume_id)?;

        let total_shards = (data_shards + parity_shards) as usize;
        let mut shards = Vec::with_capacity(total_shards);
@@ -155,12 +380,11 @@ impl EcVolume {
        // for shard-size math and by the Store-level prune in
        // `store_ec_reconcile.rs` to verify a sibling-disk .dat is
        // plausibly the encoding source (#9478).
-        let (expire_at_sec, vif_version, vif_dat_file_size, encode_ts_ns) = {
-            let vif_path = locate_vif_path(dir, dir_idx, collection, volume_id);
-            if let Ok(vif_content) = std::fs::read_to_string(&vif_path) {
-                if let Ok(vif_info) =
-                    serde_json::from_str::<crate::storage::volume::VifVolumeInfo>(&vif_content)
-                {
+        let (expire_at_sec, vif_version, vif_dat_file_size, encode_ts_ns) =
+            // Absent everywhere = legacy defaults; a present-but-unreadable or
+            // malformed vif already failed the mount in load_vif_info above.
+            match vif.as_ref() {
+                Some(vif_info) => {
                    let ver = if vif_info.version > 0 {
                        Version(vif_info.version as u8)
                    } else {
@@ -176,13 +400,9 @@ impl EcVolume {
                        vif_info.dat_file_size,
                        cfg_encode_ts_ns,
                    )
-                } else {
-                    (0, Version::current(), 0, 0)
                }
-            } else {
-                (0, Version::current(), 0, 0)
-            }
-        };
+                None => (0, Version::current(), 0, 0),
+            };

        let mut vol = EcVolume {
            volume_id,
@@ -194,6 +414,7 @@ impl EcVolume {
            dat_file_size: vif_dat_file_size,
            data_shards,
            parity_shards,
+            block_size,
            ecx_file: None,
            ecx_file_size: 0,
            ecj_file: None,
@@ -254,17 +475,33 @@ impl EcVolume {
        // Seed the in-memory deleted set from the journal.
        vol.load_deleted_needles_from_ecj()?;

-        // Load the generation-0 EC bitrot checksum sidecar (optional; best-effort).
-        vol.load_active_bitrot_sidecar();
+        // Load the generation-0 EC bitrot checksum sidecar. Optional, except
+        // when it contradicts the volume's own geometry — see
+        // load_bitrot_for_generation.
+        vol.load_active_bitrot_sidecar(&[])?;

        Ok(vol)
    }

+    /// Re-resolve the checksum sidecar for a volume that is already mounted. A
+    /// shard delivery can bring the manifest with it, and the receive path only
+    /// writes the file, so without this the in-memory volume keeps the
+    /// protection state it resolved at mount (off) until a remount.
+    pub fn reload_bitrot_sidecar(&mut self, additional_dirs: &[String]) {
+        if let Err(e) = self.load_active_bitrot_sidecar(additional_dirs) {
+            tracing::warn!(
+                volume_id = self.volume_id.0,
+                error = %e,
+                "reload bitrot sidecar",
+            );
+        }
+    }
+
    /// Load the generation-0 checksum sidecar into `self.bitrot`/`self.bitrot_status`.
    /// OSS only produces generation-0 (fresh-encode) sidecars, mirroring Go's
    /// `loadActiveBitrotSidecar`.
-    fn load_active_bitrot_sidecar(&mut self) {
-        self.load_bitrot_for_generation(0);
+    fn load_active_bitrot_sidecar(&mut self, additional_dirs: &[String]) -> io::Result<()> {
+        self.load_bitrot_for_generation(0, additional_dirs)
    }

    /// Load and validate the sidecar describing `generation`, setting
@@ -272,11 +509,60 @@ impl EcVolume {
    /// => `Off` (protection off, not corruption); self-integrity or manifest
    /// failure => `Invalid` with a warning (protection off pending repair); usable
    /// => `On`. Mirrors Go's `loadBitrotForGeneration`.
-    fn load_bitrot_for_generation(&mut self, generation: u32) {
+    fn load_bitrot_for_generation(&mut self, generation: u32, additional_dirs: &[String]) -> io::Result<()> {
        use crate::storage::erasure_coding::ec_bitrot;
-        let base = self.base_name();
-        let path = ec_bitrot::bitrot_sidecar_path(&base, generation);
+        // Data base then index base, matching Go's findBitrotSidecar. A split
+        // -dir/-dir.idx location keeps the sidecar with the INDEX, and on a
+        // multi-disk server sharing one index directory that is the only copy
+        // the per-disk runtimes other than the first can see — searching the
+        // data base alone left them reporting no protection at all.
+        let data_path = ec_bitrot::bitrot_sidecar_path(&self.base_name(), generation);
+        let idx_path = ec_bitrot::bitrot_sidecar_path(&self.idx_base_name(), generation);
+        // Sibling disks last: startup mirroring gives each shard-bearing disk
+        // its own .ecx/.ecj/.vif but not the sidecar, and a delivery lands
+        // exactly one copy, so a runtime restricted to its own two directories
+        // would report no protection however often it reloaded.
+        let path = std::iter::once(data_path.clone())
+            .chain(std::iter::once(idx_path))
+            .chain(additional_dirs.iter().filter(|d| !d.is_empty()).map(|d| {
+                ec_bitrot::bitrot_sidecar_path(
+                    &crate::storage::volume::volume_file_name(d, &self.collection, self.volume_id),
+                    generation,
+                )
+            }))
+            .find(|p| std::path::Path::new(p).exists())
+            .unwrap_or(data_path);
        let loaded = ec_bitrot::load_bitrot_sidecar(&path);
+        // A sidecar written for THIS generation that contradicts the volume's
+        // geometry is not "no protection" — it says the layout the volume is
+        // about to serve reads with is wrong. Fail the mount.
+        if let Ok(prot) = &loaded {
+            if prot.generation == generation
+                && !ec_bitrot::geometry_matches(
+                    prot,
+                    self.data_shards as usize,
+                    self.parity_shards as usize,
+                    self.block_size,
+                )
+            {
+                let cfg = prot.ec_shard_config.as_ref();
+                return Err(io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    format!(
+                        "ec volume {} generation {}: {} records layout {}+{} block {} but the volume is mounted as {}+{} block {}; refusing to serve one of the two layouts",
+                        self.volume_id.0,
+                        generation,
+                        path,
+                        cfg.map(|c| c.data_shards).unwrap_or(0),
+                        cfg.map(|c| c.parity_shards).unwrap_or(0),
+                        cfg.map(|c| c.block_size).unwrap_or(0),
+                        self.data_shards,
+                        self.parity_shards,
+                        self.block_size,
+                    ),
+                ));
+            }
+        }
        let status = ec_bitrot::resolve_status(
            &loaded,
            generation,
@@ -297,6 +583,7 @@ impl EcVolume {
                );
            }
        }
+        Ok(())
    }

    /// The active-generation bitrot protection AND its status (cached at mount),
@@ -765,6 +1052,26 @@ impl EcVolume {
        Ok(None)
    }

+    /// Large-block length of this volume's shard layout (the uniform block
+    /// size when set, the legacy 1GiB otherwise). Mirrors Go's
+    /// ECContext.LargeBlockSize.
+    pub fn large_block_size(&self) -> i64 {
+        if self.block_size > 0 {
+            self.block_size
+        } else {
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64
+        }
+    }
+
+    /// Small-block length of this volume's shard layout.
+    pub fn small_block_size(&self) -> i64 {
+        if self.block_size > 0 {
+            self.block_size
+        } else {
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64
+        }
+    }
+
    /// Locate the EC shard intervals needed to read a needle.
    /// Locate the EC shard intervals covering a needle at `actual_offset` whose
    /// index size is `size`. Mirrors Go's EcVolume.LocateEcShardNeedleInterval.
@@ -783,7 +1090,27 @@ impl EcVolume {
        };
        // locate_data wants the on-disk size (header+body+checksum+timestamp+padding).
        let actual = get_actual_size(size, self.version);
-        ec_locate::locate_data(actual_offset, Size(actual as i32), shard_size, self.data_shards)
+        ec_locate::locate_data(
+            actual_offset,
+            Size(actual as i32),
+            shard_size,
+            self.data_shards,
+            self.large_block_size(),
+            self.small_block_size(),
+        )
+    }
+
+    /// Resolve an interval against this volume's shard block layout. Mirrors
+    /// Go's EcVolume.IntervalToShardIdAndOffset.
+    pub fn interval_to_shard_id_and_offset(
+        &self,
+        interval: &ec_locate::Interval,
+    ) -> (ShardId, i64) {
+        interval.to_shard_id_and_offset(
+            self.data_shards,
+            self.large_block_size(),
+            self.small_block_size(),
+        )
    }

    pub fn locate_needle(
@@ -829,7 +1156,7 @@ impl EcVolume {
        let mut bytes = Vec::with_capacity(actual_size);

        for interval in &intervals {
-            let (shard_id, shard_offset) = interval.to_shard_id_and_offset(self.data_shards);
+            let (shard_id, shard_offset) = self.interval_to_shard_id_and_offset(interval);
            let shard = self
                .shards
                .get(shard_id as usize)
@@ -989,7 +1316,7 @@ impl EcVolume {
            // A needle is verifiable locally only if every shard it spans is local;
            // when any is remote, skip the reassembly buffer entirely.
            let has_remote_chunks = locations.iter().any(|iv| {
-                let (sid, _) = iv.to_shard_id_and_offset(self.data_shards);
+                let (sid, _) = self.interval_to_shard_id_and_offset(iv);
                self.shards.get(sid as usize).and_then(|s| s.as_ref()).is_none()
            });
            let mut read: i64 = 0;
@@ -1001,7 +1328,7 @@ impl EcVolume {
            let mut local_shard_ids: Vec<ShardId> = Vec::new();

            for (i, iv) in locations.iter().enumerate() {
-                let (sid, soffset) = iv.to_shard_id_and_offset(self.data_shards);
+                let (sid, soffset) = self.interval_to_shard_id_and_offset(iv);
                let ssize = iv.size;
                let shard = match self.shards.get(sid as usize).and_then(|s| s.as_ref()) {
                    Some(s) => s,
@@ -1800,8 +2127,14 @@ mod tests {
        assert_eq!(vol.parity_shards, 3);
    }

+    /// A vif that RECORDS a ratio no volume could have must fail the mount.
+    /// Substituting the default 10+4 (and with it the legacy block layout)
+    /// would read a uniform volume's shards at the wrong offsets and answer
+    /// with the wrong bytes; only an entirely absent config means "this
+    /// predates the record", which
+    /// `test_ec_volume_absent_vif_config_uses_defaults` covers.
    #[test]
-    fn test_ec_volume_invalid_vif_config_falls_back_to_defaults() {
+    fn test_ec_volume_invalid_vif_config_fails_the_mount() {
        let tmp = TempDir::new().unwrap();
        let dir = tmp.path().to_str().unwrap();
        write_ecx_file(dir, "pics", VolumeId(1), &[]);
@@ -1822,9 +2155,27 @@ mod tests {
        )
        .unwrap();

+        // EcVolume has no Debug impl, so match rather than expect_err.
+        match EcVolume::new(dir, dir, "pics", VolumeId(1)) {
+            Ok(_) => panic!("an impossible ratio must fail the mount"),
+            Err(e) => assert_eq!(e.kind(), io::ErrorKind::InvalidData, "got {e}"),
+        }
+    }
+
+    /// The compatibility case the check above must not swallow: a vif with no
+    /// EC config at all predates the record, and mounts on the defaults.
+    #[test]
+    fn test_ec_volume_absent_vif_config_uses_defaults() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        write_ecx_file(dir, "pics", VolumeId(1), &[]);
+        let base = crate::storage::volume::volume_file_name(dir, "pics", VolumeId(1));
+        std::fs::write(format!("{}.vif", base), r#"{"version":3}"#).unwrap();
+
        let vol = EcVolume::new(dir, dir, "pics", VolumeId(1)).unwrap();
        assert_eq!(vol.data_shards, DATA_SHARDS_COUNT as u32);
        assert_eq!(vol.parity_shards, PARITY_SHARDS_COUNT as u32);
+        assert_eq!(vol.block_size, 0, "legacy layout for a pre-record volume");
    }

    #[test]
@@ -1973,3 +2324,370 @@ mod tests {
        );
    }
 }
+
+#[cfg(test)]
+mod uniform_layout_tests {
+    use super::*;
+    use crate::storage::needle_map::NeedleMapKind;
+    use crate::storage::volume::{VifEcShardConfig, VifVolumeInfo, Volume};
+    use tempfile::TempDir;
+
+    // Write ~26MB of needles so the uniform block size (3MB) diverges from the
+    // legacy layout, encode, and verify EcVolume reads every needle back
+    // through the .vif-recorded geometry. A legacy-encoded fixture (no .vif
+    // block size) must keep reading through the legacy interpretation.
+    #[test]
+    fn test_read_needles_uniform_and_legacy_layouts() {
+        for legacy in [false, true] {
+            let tmp = TempDir::new().unwrap();
+            let dir = tmp.path().to_str().unwrap();
+            let vid = VolumeId(8);
+
+            let mut v = Volume::new(
+                dir,
+                dir,
+                "",
+                vid,
+                NeedleMapKind::InMemory,
+                None,
+                None,
+                0,
+                Version::current(),
+            )
+            .unwrap();
+            let mut expected: Vec<(NeedleId, Vec<u8>)> = Vec::new();
+            for i in 1u64..=11 {
+                let size = if i <= 5 { 4 << 20 } else { 1 << 20 };
+                let data: Vec<u8> = (0..size)
+                    .map(|b| ((b as u64).wrapping_mul(2654435761).wrapping_add(i) >> 8) as u8)
+                    .collect();
+                let mut n = Needle {
+                    id: NeedleId(i),
+                    cookie: Cookie(i as u32),
+                    data: data.clone(),
+                    data_size: data.len() as u32,
+                    ..Needle::default()
+                };
+                v.write_needle(&mut n, true, false).unwrap();
+                expected.push((NeedleId(i), data));
+            }
+            v.sync_to_disk().unwrap();
+            let dat_size = v.dat_file_size().unwrap() as i64;
+            v.close();
+
+            let block_size = if legacy {
+                // Legacy fixture: two-tier encode plus a .vif without a block
+                // size, the state every pre-upgrade EC volume is in.
+                use crate::storage::erasure_coding::ec_bitrot::{
+                    ShardChecksumBuilder, DEFAULT_BITROT_BLOCK_SIZE,
+                };
+                use reed_solomon_erasure::galois_8::ReedSolomon;
+                let base = crate::storage::volume::volume_file_name(dir, "", vid);
+                crate::storage::erasure_coding::ec_encoder::write_sorted_ecx_from_idx(
+                    &format!("{}.idx", base),
+                    &format!("{}.ecx", base),
+                )
+                .unwrap();
+                let dat_file = std::fs::File::open(format!("{}.dat", base)).unwrap();
+                let rs = ReedSolomon::new(10, 4).unwrap();
+                let mut shards: Vec<EcVolumeShard> = (0..14u8)
+                    .map(|i| EcVolumeShard::new(dir, "", vid, i))
+                    .collect();
+                for shard in &mut shards {
+                    shard.create().unwrap();
+                }
+                let mut builders: Vec<ShardChecksumBuilder> = (0..14)
+                    .map(|_| ShardChecksumBuilder::new(DEFAULT_BITROT_BLOCK_SIZE as i64))
+                    .collect();
+                crate::storage::erasure_coding::ec_encoder::encode_dat_file(
+                    &dat_file,
+                    dat_size,
+                    &rs,
+                    &mut shards,
+                    &mut builders,
+                    10,
+                    4,
+                    256 * 1024,
+                    ERASURE_CODING_LARGE_BLOCK_SIZE,
+                    ERASURE_CODING_SMALL_BLOCK_SIZE,
+                )
+                .unwrap();
+                for shard in &mut shards {
+                    shard.close();
+                }
+                0
+            } else {
+                let bs = crate::storage::erasure_coding::ec_encoder::write_ec_files(
+                    dir, dir, "", vid, 10, 4,
+                )
+                .unwrap();
+                assert!(
+                    bs > ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+                    "block size {} does not diverge from the legacy layout",
+                    bs
+                );
+                bs
+            };
+
+            let base = crate::storage::volume::volume_file_name(dir, "", vid);
+            let vif = VifVolumeInfo {
+                version: Version::current().0 as u32,
+                dat_file_size: dat_size,
+                ec_shard_config: Some(VifEcShardConfig {
+                    data_shards: 10,
+                    parity_shards: 4,
+                    block_size,
+                    ..Default::default()
+                }),
+                ..Default::default()
+            };
+            std::fs::write(
+                format!("{}.vif", base),
+                serde_json::to_string_pretty(&vif).unwrap(),
+            )
+            .unwrap();
+            std::fs::remove_file(format!("{}.dat", base)).unwrap();
+            std::fs::remove_file(format!("{}.idx", base)).unwrap();
+
+            let mut vol = EcVolume::new(dir, dir, "", vid).unwrap();
+            assert_eq!(vol.block_size, block_size, "block size not loaded from .vif");
+            for i in 0..10u8 {
+                vol.add_shard(EcVolumeShard::new(dir, "", vid, i)).unwrap();
+            }
+
+            for (id, data) in &expected {
+                let n = vol
+                    .read_ec_shard_needle(*id)
+                    .unwrap()
+                    .unwrap_or_else(|| panic!("needle {} not found (legacy={})", id.0, legacy));
+                assert_eq!(
+                    n.data, *data,
+                    "needle {} data mismatch (legacy={})",
+                    id.0, legacy
+                );
+            }
+        }
+    }
+
+    // A present-but-malformed .vif must FAIL the mount: every new encode
+    // records a positive uniform block size there, and silently defaulting
+    // to the legacy layout would serve those shards with the wrong offset
+    // math. Absence stays legal — legacy volumes predate the sidecar.
+    #[test]
+    fn new_fails_on_malformed_vif() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let base = crate::storage::volume::volume_file_name(dir, "", VolumeId(1));
+        std::fs::write(format!("{}.ecx", base), b"").unwrap();
+        std::fs::write(format!("{}.vif", base), b"not json").unwrap();
+        let res = EcVolume::new(dir, dir, "", VolumeId(1));
+        assert!(res.is_err(), "mount over a malformed .vif must fail");
+    }
+
+    #[test]
+    fn new_absent_vif_mounts_with_defaults() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let base = crate::storage::volume::volume_file_name(dir, "", VolumeId(1));
+        std::fs::write(format!("{}.ecx", base), b"").unwrap();
+        let ev = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
+        assert_eq!(ev.block_size, 0, "legacy mount must use the legacy layout");
+    }
+
+    /// A rebuild lands on one disk, but the volume's metadata may live on
+    /// another. Reading only the selected directory returns the default 10+4
+    /// and the legacy block layout, which reconstructs a custom-ratio or
+    /// uniform volume through the wrong matrix.
+    fn seed_uniform_sidecar(base: &str, ds: u32, ps: u32, block: i64) {
+        use crate::pb::volume_server_pb::{ChecksumAlgorithm, EcBitrotProtection, EcShardChecksums};
+        use crate::storage::erasure_coding::ec_bitrot;
+        let prot = EcBitrotProtection {
+            algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
+            block_size: ec_bitrot::DEFAULT_BITROT_BLOCK_SIZE as u32,
+            generation: 0,
+            ec_shard_config: Some(ec_bitrot::ec_shard_config(ds, ps, block)),
+            shards: (0..(ds + ps))
+                .map(|shard_id| EcShardChecksums {
+                    shard_id,
+                    covered_size: 4,
+                    block_crc32c: vec![0u8; 4],
+                })
+                .collect(),
+            encode_uuid: vec![0u8; 16],
+        };
+        ec_bitrot::save_bitrot_sidecar(&ec_bitrot::bitrot_sidecar_path(base, 0), &prot).unwrap();
+    }
+
+    fn seed_config_free_vif(base: &str) {
+        std::fs::write(
+            format!("{}.vif", base),
+            r#"{"version":3,"datFileSize":0}"#,
+        )
+        .unwrap();
+    }
+
+    // A .vif that omits ecShardConfig answers nothing about the layout, so it
+    // must not short-circuit the sidecar search. Returning as soon as any
+    // parseable vif turned up resolved a 12+4 uniform volume as 10+4 legacy.
+    #[test]
+    fn read_ec_shard_config_falls_back_when_the_vif_has_no_config() {
+        let d = tempfile::TempDir::new().unwrap();
+        let dir = d.path().to_str().unwrap();
+        let base = crate::storage::volume::volume_file_name(dir, "", VolumeId(11));
+        seed_config_free_vif(&base);
+        seed_uniform_sidecar(&base, 12, 4, 3 * 1024 * 1024);
+
+        let got = read_ec_shard_config(dir, dir, "", VolumeId(11)).unwrap();
+        assert_eq!(got, (12, 4, 3 * 1024 * 1024));
+    }
+
+    // Split -dir/-dir.idx: the vif and the sidecar both live with the INDEX,
+    // and the resolver was told to report the DATA directory, so the fallback
+    // looked in a directory holding neither.
+    #[test]
+    fn read_ec_shard_config_finds_a_config_free_vifs_sidecar_in_the_index_dir() {
+        let data = tempfile::TempDir::new().unwrap();
+        let idx = tempfile::TempDir::new().unwrap();
+        let (dir, dir_idx) = (data.path().to_str().unwrap(), idx.path().to_str().unwrap());
+        let idx_base = crate::storage::volume::volume_file_name(dir_idx, "", VolumeId(12));
+        seed_config_free_vif(&idx_base);
+        seed_uniform_sidecar(&idx_base, 12, 4, 3 * 1024 * 1024);
+
+        let got = read_ec_shard_config(dir, dir_idx, "", VolumeId(12)).unwrap();
+        assert_eq!(got, (12, 4, 3 * 1024 * 1024));
+    }
+
+    // Same gap in the cross-disk resolver the rebuild uses.
+    #[test]
+    fn read_ec_shard_config_across_dirs_falls_back_when_the_vif_has_no_config() {
+        let data = tempfile::TempDir::new().unwrap();
+        let sib = tempfile::TempDir::new().unwrap();
+        let (dir, sibling) = (data.path().to_str().unwrap(), sib.path().to_str().unwrap());
+        seed_config_free_vif(&crate::storage::volume::volume_file_name(dir, "", VolumeId(13)));
+        seed_uniform_sidecar(
+            &crate::storage::volume::volume_file_name(sibling, "", VolumeId(13)),
+            12,
+            4,
+            3 * 1024 * 1024,
+        );
+
+        let got = read_ec_shard_config_across_dirs(
+            dir,
+            dir,
+            &[sibling.to_string()],
+            "",
+            VolumeId(13),
+        )
+        .unwrap();
+        assert_eq!(got, (12, 4, 3 * 1024 * 1024));
+    }
+
+    // Absence stays legal: a volume predating both records is genuinely legacy.
+    #[test]
+    fn read_ec_shard_config_config_free_vif_without_a_sidecar_is_legacy() {
+        let d = tempfile::TempDir::new().unwrap();
+        let dir = d.path().to_str().unwrap();
+        seed_config_free_vif(&crate::storage::volume::volume_file_name(dir, "", VolumeId(14)));
+        let got = read_ec_shard_config(dir, dir, "", VolumeId(14)).unwrap();
+        assert_eq!(got, (10, 4, 0));
+    }
+
+    #[test]
+    fn read_ec_shard_config_finds_a_sibling_disks_vif() {
+        let a = tempfile::TempDir::new().unwrap();
+        let b = tempfile::TempDir::new().unwrap();
+        let (rebuild, sibling) = (a.path().to_str().unwrap(), b.path().to_str().unwrap());
+        let base = crate::storage::volume::volume_file_name(sibling, "", VolumeId(3));
+        std::fs::write(
+            format!("{}.vif", base),
+            r#"{"version":3,"ecShardConfig":{"dataShards":12,"parityShards":4,"blockSize":3145728}}"#,
+        )
+        .unwrap();
+
+        let (ds, ps, bs) = read_ec_shard_config_across_dirs(
+            rebuild,
+            rebuild,
+            &[sibling.to_string()],
+            "",
+            VolumeId(3),
+        )
+        .unwrap();
+        assert_eq!((ds, ps, bs), (12, 4, 3 * 1024 * 1024));
+    }
+
+    /// Same, for the sidecar: with no .vif anywhere it is the surviving record
+    /// of the geometry, wherever it sits.
+    // A split -dir/-dir.idx location keeps its metadata with the INDEX, and
+    // callers leave their own index directory out of other_dirs because it is
+    // passed separately. With no .vif anywhere the generation-0 .ecsum is the
+    // only record of the layout, so missing that directory resolves a 12+4
+    // uniform volume to 10+4 legacy and reconstructs through the wrong matrix.
+    #[test]
+    fn read_ec_shard_config_finds_the_sidecar_in_its_own_index_dir() {
+        use crate::pb::volume_server_pb::{ChecksumAlgorithm, EcBitrotProtection, EcShardChecksums};
+        use crate::storage::erasure_coding::ec_bitrot;
+
+        let data = tempfile::TempDir::new().unwrap();
+        let idx = tempfile::TempDir::new().unwrap();
+        let (dir, dir_idx) = (
+            data.path().to_str().unwrap(),
+            idx.path().to_str().unwrap(),
+        );
+        let base = crate::storage::volume::volume_file_name(dir_idx, "", VolumeId(7));
+        let prot = EcBitrotProtection {
+            algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
+            block_size: ec_bitrot::DEFAULT_BITROT_BLOCK_SIZE as u32,
+            generation: 0,
+            ec_shard_config: Some(ec_bitrot::ec_shard_config(12, 4, 3 * 1024 * 1024)),
+            shards: (0..16u32)
+                .map(|shard_id| EcShardChecksums {
+                    shard_id,
+                    covered_size: 4,
+                    block_crc32c: vec![0u8; 4],
+                })
+                .collect(),
+            encode_uuid: vec![0u8; 16],
+        };
+        ec_bitrot::save_bitrot_sidecar(&ec_bitrot::bitrot_sidecar_path(&base, 0), &prot).unwrap();
+
+        let (ds, ps, bs) =
+            read_ec_shard_config_across_dirs(dir, dir_idx, &[], "", VolumeId(7)).unwrap();
+        assert_eq!((ds, ps, bs), (12, 4, 3 * 1024 * 1024));
+    }
+
+    #[test]
+    fn read_ec_shard_config_finds_a_sibling_disks_sidecar() {
+        use crate::pb::volume_server_pb::{ChecksumAlgorithm, EcBitrotProtection, EcShardChecksums};
+        use crate::storage::erasure_coding::ec_bitrot;
+
+        let a = tempfile::TempDir::new().unwrap();
+        let b = tempfile::TempDir::new().unwrap();
+        let (rebuild, sibling) = (a.path().to_str().unwrap(), b.path().to_str().unwrap());
+        let base = crate::storage::volume::volume_file_name(sibling, "", VolumeId(4));
+        let prot = EcBitrotProtection {
+            algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
+            block_size: ec_bitrot::DEFAULT_BITROT_BLOCK_SIZE as u32,
+            generation: 0,
+            ec_shard_config: Some(ec_bitrot::ec_shard_config(12, 4, 3 * 1024 * 1024)),
+            shards: (0..16u32)
+                .map(|shard_id| EcShardChecksums {
+                    shard_id,
+                    covered_size: 4,
+                    block_crc32c: vec![0u8; 4],
+                })
+                .collect(),
+            encode_uuid: vec![0u8; 16],
+        };
+        ec_bitrot::save_bitrot_sidecar(&ec_bitrot::bitrot_sidecar_path(&base, 0), &prot).unwrap();
+
+        let (ds, ps, bs) = read_ec_shard_config_across_dirs(
+            rebuild,
+            rebuild,
+            &[sibling.to_string()],
+            "",
+            VolumeId(4),
+        )
+        .unwrap();
+        assert_eq!((ds, ps, bs), (12, 4, 3 * 1024 * 1024));
+    }
+}
@@ -804,6 +804,37 @@ impl Store {
    }

    /// Find an EC volume across all locations (mutable).
+    /// Every per-disk `EcVolume` this store maps for `vid`. A vid can mount on
+    /// N disks as N distinct runtimes, and the first-match `find_ec_volume_mut`
+    /// hides the siblings — so anything that has to reach the whole volume,
+    /// rather than any one runtime of it, iterates this instead.
+    /// Every directory on this server that could hold an EC volume's metadata —
+    /// each disk's data and index directory. Startup mirroring gives each
+    /// shard-bearing disk its own .ecx/.ecj/.vif, but the checksum sidecar is
+    /// not mirrored and a repair delivers exactly one copy, so a runtime looking
+    /// only at its own two directories cannot see it. Handing this list to the
+    /// sidecar resolution keeps one authoritative copy reachable from every
+    /// runtime rather than duplicating a file that is rewritten as shards are
+    /// repaired and generations published.
+    pub fn ec_metadata_dirs(&self) -> Vec<String> {
+        let mut dirs: Vec<String> = Vec::with_capacity(self.locations.len() * 2);
+        for loc in &self.locations {
+            for dir in [&loc.directory, &loc.idx_directory] {
+                if !dir.is_empty() && !dirs.iter().any(|d| d == dir) {
+                    dirs.push(dir.clone());
+                }
+            }
+        }
+        dirs
+    }
+
+    pub fn find_all_ec_volumes_mut(&mut self, vid: VolumeId) -> Vec<&mut EcVolume> {
+        self.locations
+            .iter_mut()
+            .filter_map(|loc| loc.find_ec_volume_mut(vid))
+            .collect()
+    }
+
    pub fn find_ec_volume_mut(&mut self, vid: VolumeId) -> Option<&mut EcVolume> {
        for loc in &mut self.locations {
            if let Some(ecv) = loc.find_ec_volume_mut(vid) {
@@ -194,6 +194,10 @@ pub struct VifEcShardConfig {
    /// so a read served from a different run's shard is rejected.
    #[serde(default, rename = "encodeTsNs", with = "string_or_i64")]
    pub encode_ts_ns: i64,
+    /// Uniform block layout: each shard is a single contiguous block of this
+    /// many bytes. 0 = legacy 1GiB/1MiB two-tier layout.
+    #[serde(default, rename = "blockSize", with = "string_or_i64")]
+    pub block_size: i64,
 }

 /// Serde-compatible representation of OldVersionVolumeInfo for legacy .vif JSON deserialization.
@@ -288,6 +292,7 @@ impl VifVolumeInfo {
                data_shards: c.data_shards,
                parity_shards: c.parity_shards,
                encode_ts_ns: c.encode_ts_ns,
+                block_size: c.block_size,
            }),
            read_only_can_delete: pb.read_only_can_delete,
        }
@@ -320,6 +325,7 @@ impl VifVolumeInfo {
                    data_shards: c.data_shards,
                    parity_shards: c.parity_shards,
                    encode_ts_ns: c.encode_ts_ns,
+                    block_size: c.block_size,
                }
            }),
            read_only_can_delete: self.read_only_can_delete,