VolumeMarkReadonly blocks local writes and deletes before its second master
notification, so a failed notification returns an error with the source
already frozen. Restore it whenever the status was read.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A stale twin on another disk of a replaced server still references the
object but is filtered out with its server.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tier download deleted the shared object once the listed replicas were
local, even when the replica placement expected more copies than the
topology listed. Keep it in that case so a rerun can finish later.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A readonly-can-delete source took deletes after VolumeCopy read its
index, so the replaced replica lost them and served the files again.
Hard-mark the source readonly while replicas are replaced, then restore
the writable mark or reload the persisted state.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
VolumeCopy treats an empty disk type as the source's, so an HDD replica
copied from an SSD source was placed on SSD or failed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
