feat(ecstore): protect streaming GETs with snapshot leases

[cxymds]

Related Issues

Related to rustfs/backlog#1526.

Stacked on #5389.

Summary of Changes

• Acquire data-directory snapshot leases on every candidate disk before releasing the namespace read lock for a streaming GET.
• Fall back to retaining the namespace lock when any candidate is unavailable, an older peer does not implement the lease protocol, or the lease set cannot satisfy read quorum.
• Renew leases while the response is active and terminate the reader if renewal fails.
• Release leases idempotently on EOF, read failure, cancellation, or drop, while sharing lease ownership with the legacy erasure producer task.
• Keep inline, materialized, cache, direct-memory, and transitioned-object paths on their existing behavior.

Verification

• cargo test -p rustfs-ecstore snapshot_lease_acquisition_is_all_or_nothing --lib
• cargo test -p rustfs-ecstore snapshot_lease_reader_fails_when_renewal_fails --lib
• cargo test -p rustfs-ecstore streaming_get_snapshot_survives_concurrent_overwrite --lib
• cargo fmt --all --check
• git diff --check
• make pre-commit

Impact

When the GET lock optimization is enabled, streaming reads can release the namespace lock after snapshot protection is established, so concurrent overwrites proceed without invalidating the in-flight response. Mixed-version or lease-degraded clusters fail safely by retaining the existing lock for the response lifetime. No configuration or public API changes are introduced.

Additional Notes

High-risk adversarial validation:

• Correctness: attacked partial acquisition, read-quorum boundaries, overwrite races, EOF, cancellation, and renewal failure; partial acquisition is released and the lock fallback remains active.
• Simplicity: attacked helper duplication and unnecessary path changes; lease logic is shared by codec and legacy streaming paths and materialized paths remain unchanged.
• Security: attacked untrusted object paths and unauthenticated lease use; disk path mapping is unchanged and remote operations use the authenticated internode protocol from feat(ecstore): add remote snapshot lease RPCs #5389.
• Concurrency/durability: found and fixed release scheduling outside the current Tokio context by retaining the creation runtime handle; attacked renewal/drop races and producer/body ownership with no remaining break found.
• Compatibility: attacked older peers and mixed-version deployments; unsupported acquisition triggers the lock-preserving fallback.
• Performance: attacked sequential disk RPCs, materialized-read overhead, and renewal cadence; disk operations are concurrent and renewal runs only for active streaming bodies.
• Test coverage: revert checks cover all-or-nothing acquisition, renewal-failure termination, concurrent overwrite snapshot consistency, and cancellation/drop cleanup.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md). If this is your first contribution, review the CLA document and sign it by commenting I have read and agree to the CLA. on the PR.

[github-actions]

CLA requirements are satisfied for this pull request.

[Copilot]

Pull request overview

This PR integrates snapshot-lease protection into streaming GET so the namespace read lock can be released once read-quorum snapshot safety is established, allowing concurrent overwrites without invalidating an in-flight response.

Changes:

• Adds snapshot-lease RPC messages, canonical-body digest binding, and NodeService handlers (including TTL bounds and server-side expiry scheduling).
• Extends Disk APIs (local + remote) with acquire/renew/release lease operations and token parsing/validation.
• Wires lease acquisition + periodic renewal into the ecstore streaming GET path, with drop/EOF/error cleanup and fallback to holding the namespace lock.

Reviewed changes

Copilot reviewed 14 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
rustfs/src/storage/storage_api.rs	Exposes SnapshotLeaseToken and extends StorageDiskRpcExt with snapshot-lease methods.
rustfs/src/storage/rpc/node_service/disk.rs	Implements snapshot-lease RPC handlers + TTL validation + server-side expiry scheduler.
rustfs/src/storage/rpc/node_service.rs	Stores the lease expiry scheduler in NodeService and wires the new RPC methods.
rustfs/Cargo.toml	Enables tokio-util time feature to support DelayQueue.
crates/protos/src/node.proto	Adds snapshot-lease request/response messages and RPC definitions.
crates/protos/src/lib.rs	Adds canonical-body builders for snapshot-lease RPCs and canonical binding tests.
crates/protos/src/generated/proto_gen/node_service.rs	Regenerates prost/tonic bindings for new messages/RPCs.
crates/ecstore/src/set_disk/ops/object.rs	Acquires snapshot leases for streaming GET and replaces lock guarding with SnapshotLeaseReader when possible.
crates/ecstore/src/set_disk/mod.rs	Adds lease state/renewal machinery, wraps streaming bodies, and adds integration tests for overwrite/drop behavior.
crates/ecstore/src/disk/mod.rs	Adds token parsing/byte serialization and DiskAPI renew support.
crates/ecstore/src/disk/local.rs	Implements local-disk lease renewal and updates tests for superseded-token idempotency.
crates/ecstore/src/disk/disk_store.rs	Routes renew through disk health tracking wrapper.
crates/ecstore/src/cluster/rpc/remote_disk.rs	Implements remote acquire/renew/release RPC calls and validates protocol/token in responses.
crates/ecstore/src/api/mod.rs	Re-exports SnapshotLeaseToken via the ecstore API module.
crates/e2e_test/src/reliant/grpc_lock_server.rs	Updates minimal NodeService test double to include new unimplemented lease RPCs.
Cargo.lock	Locks additional deps pulled in by enabling tokio-util time support.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None