@git.zone/cli 3.2.1 → 4.0.0

package/ts/mod_services/classes.servicemanager.ts

@@ -3,21 +3,43 @@ import * as helpers from './helpers.js';
 import {
   ServiceConfiguration,
   getS3BucketNameValidationError,
+  type IServiceConfig,
 } from './classes.serviceconfiguration.js';
 import {
   DockerContainer,
   matchDockerUlimits,
-  type IDockerExecArgvResult,
+  type IContainerInspectInfo,
   type TDockerUlimits,
 } from './classes.dockercontainer.js';
 import { GlobalRegistry } from './classes.globalregistry.js';
 import {
+  getLegacyMinioDataDirectory,
   getServiceContainerLabels,
+  getServiceDataDirectory,
+  hasExactServiceContainerLabels,
+  markerProvesServiceDataDirectory,
+  objectStorageImage,
+  readServiceDataMarker,
   recordServiceDataDirectory,
+  serviceBindOperation,
   serviceImages,
+  serviceNames,
+  serviceOperationLabel,
+  serviceToolLabel,
   type TServiceName,
 } from './classes.servicedatamarker.js';
+import { readPersistedServiceConfiguration } from './classes.servicenames.js';
+import { withServiceDataOperationLock } from './classes.interprocesslock.js';
+import {
+  runServiceMigrations,
+  type TServiceMigrationScope,
+} from '../../ts_migration/index.js';
 import { logger } from '../gitzone.logging.js';
+import {
+  readSmartconfigFile,
+  setCliConfigValueInData,
+  writeSmartconfigFile,
+} from '../helpers.smartconfig.js';
 import type { ContainerStatus } from './classes.dockercontainer.js';
 import type { TServiceOptionSource } from './classes.serviceoptions.js';
 
@@ -36,8 +58,35 @@ export interface IServiceStatus {
   authEnabled?: boolean;
   /** MongoDB only: whether the auth mode is declared in committed config. */
   authSource?: TServiceOptionSource;
+  /** ObjectStorage only: an unowned same-name container is a conflict, not managed state. */
+  ownership?: 'owned' | 'conflict' | 'absent';
+  managementUi?: string;
 }
 
+export type TServiceManagerOperation =
+  | 'auth'
+  | 'clean'
+  | 'compass'
+  | 'config'
+  | 'logs'
+  | 'remove'
+  | 'reconfigure'
+  | 'restart'
+  | 'start'
+  | 'status'
+  | 'stop';
+
+export const getServiceManagerMigrationScopes = (
+  operationArg: TServiceManagerOperation,
+): TServiceMigrationScope[] => [
+  'global-registry',
+  'service-selection',
+  'runtime-config',
+  ...(['start', 'restart', 'reconfigure', 'clean'].includes(operationArg)
+    ? (['service-data-marker'] as const)
+    : []),
+];
+
 export interface IServicesStatus {
   project: {
     name: string;
@@ -46,9 +95,14 @@ export interface IServicesStatus {
   };
   services: {
     mongodb: IServiceStatus;
-    minio: IServiceStatus;
+    objectstorage: IServiceStatus;
     elasticsearch: IServiceStatus;
   };
+  legacy: {
+    minioContainer?: string;
+    minioDataDirectory: string;
+    minioDataExists: boolean;
+  };
   totalDataBytes: number;
 }
 
@@ -59,96 +113,191 @@ export const mongoServiceUlimits = {
   },
 } as const satisfies TDockerUlimits;
 
-export const minioReconciliationTimeoutMs = 30_000;
-const minioProbeTimeoutCapMs = 2_000;
-const minioProbeIntervalMs = 250;
-const minioRollbackTimeoutMs = 5_000;
-const minioAlias = 'gitzone-local';
-const minioAliasSetupScript =
-  'mc alias set gitzone-local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" >/dev/null';
+export const objectStorageReconciliationTimeoutMs = 30_000;
+const objectStorageProbeTimeoutCapMs = 2_000;
+const objectStorageProbeIntervalMs = 250;
+const objectStorageRollbackTimeoutMs = 5_000;
 
-export interface IMinioReconciliationClock {
+export interface IObjectStorageReconciliationClock {
   now(): number;
   delay(millisecondsArg: number): Promise<void>;
 }
 
-export interface IMinioReconciliationOptions {
-  docker: Pick<DockerContainer, 'execArgv'>;
-  /** Full immutable Docker container id; mutable names are never accepted here. */
-  containerId: string;
+export interface IObjectStorageBucketReconciliationOptions {
+  smartBucket: Pick<plugins.smartbucket.SmartBucket, 'checkReadiness' | 'close'> & {
+    storageClient: {
+      send(
+        commandArg: plugins.s3.HeadBucketCommand | plugins.s3.CreateBucketCommand,
+        optionsArg?: { abortSignal?: AbortSignal },
+      ): Promise<unknown>;
+    };
+  };
   bucket: string;
-  /** Shared absolute deadline. Defaults to 30 seconds from this call. */
   deadlineAt?: number;
-  clock?: IMinioReconciliationClock;
+  clock?: IObjectStorageReconciliationClock;
 }
 
-const defaultMinioClock: IMinioReconciliationClock = {
+const defaultObjectStorageClock: IObjectStorageReconciliationClock = {
   now: () => Date.now(),
   delay: async (millisecondsArg) => plugins.smartdelay.delayFor(millisecondsArg),
 };
 
-class MinioStageError extends Error {
+class ObjectStorageStageError extends Error {
   constructor(stageArg: string, timedOutArg: boolean, causeArg?: unknown) {
     const message = timedOutArg
-      ? `MinIO ${stageArg} did not complete before the shared reconciliation deadline.`
-      : `MinIO ${stageArg} failed.`;
+      ? `ObjectStorage ${stageArg} did not complete before the shared reconciliation deadline.`
+      : `ObjectStorage ${stageArg} failed.`;
     super(message, causeArg === undefined ? undefined : { cause: causeArg });
-    this.name = 'MinioStageError';
+    this.name = 'ObjectStorageStageError';
   }
 }
 
-const minioStageError = (
+const objectStorageStageError = (
   stageArg: string,
   timedOutArg: boolean,
   causeArg?: unknown,
-): MinioStageError => {
-  return new MinioStageError(stageArg, timedOutArg, causeArg);
+): ObjectStorageStageError => {
+  return new ObjectStorageStageError(stageArg, timedOutArg, causeArg);
 };
 
-const minioStageCause = (errorArg: unknown): unknown => {
-  if (errorArg instanceof MinioStageError && errorArg.cause !== undefined) {
-    return errorArg.cause;
-  }
-  return errorArg;
-};
-
-const normalizeMinioLifecycleError = (errorArg: unknown): Error => {
+const normalizeObjectStorageLifecycleError = (errorArg: unknown): Error => {
   return errorArg instanceof Error
     ? errorArg
-    : new Error('MinIO lifecycle failed with a non-Error rejection.');
+    : new Error('ObjectStorage lifecycle failed with a non-Error rejection.');
 };
 
-interface IMinioContainerInspection {
+interface IObjectStorageContainerInspection {
   id: string;
   name: string;
   running: boolean;
+  status: string;
+  image: string;
   portBindings: Record<string, unknown>;
   environmentEntries: string[];
   labels: Record<string, string>;
+  mounts: Array<{ source: string; destination: string; readWrite: boolean }>;
+  restartPolicy: string;
+  command: string[];
+  entrypoint: string[];
+  user: string;
+  healthcheck: {
+    test: string[];
+    interval: number;
+    timeout: number;
+    startPeriod: number;
+    retries: number;
+  };
+}
+
+interface IObjectStorageContainerIdentity {
+  id: string;
+  name: string;
+  running: boolean;
+  status: string;
+  labels: Record<string, string>;
 }
 
 const isUnknownRecord = (valueArg: unknown): valueArg is Record<string, unknown> => {
   return typeof valueArg === 'object' && valueArg !== null && !Array.isArray(valueArg);
 };
 
-const parseMinioInspection = (
+export const objectStorageExpectedEntrypoint = ['/usr/bin/tini', '--'];
+export const objectStorageExpectedCommand = [
+  'deno',
+  'run',
+  '--allow-all',
+  'mod.ts',
+  'server',
+];
+export const objectStorageExpectedHealthcheck = {
+  test: [
+    'CMD-SHELL',
+    `deno eval "const response = await fetch('http://127.0.0.1:3000/readyz'); Deno.exit(response.ok ? 0 : 1);"`,
+  ],
+  interval: 30_000_000_000,
+  timeout: 5_000_000_000,
+  startPeriod: 10_000_000_000,
+  retries: 3,
+};
+
+const parseObjectStorageIdentity = (
+  stdoutArg: string,
+  expectedContainerNameArg: string,
+): IObjectStorageContainerIdentity => {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(stdoutArg);
+  } catch {
+    throw new Error(
+      `Docker returned an invalid ObjectStorage identity for ${expectedContainerNameArg}.`,
+    );
+  }
+  if (!Array.isArray(parsed) || parsed.length !== 1 || !isUnknownRecord(parsed[0])) {
+    throw new Error(
+      `Docker returned an invalid ObjectStorage identity for ${expectedContainerNameArg}.`,
+    );
+  }
+  const inspected = parsed[0];
+  const state = inspected.State;
+  const config = inspected.Config;
+  const normalizedName =
+    typeof inspected.Name === 'string' ? inspected.Name.replace(/^\//u, '') : undefined;
+  if (
+    typeof inspected.Id !== 'string' ||
+    !/^[a-f0-9]{64}$/u.test(inspected.Id) ||
+    normalizedName !== expectedContainerNameArg ||
+    !isUnknownRecord(state) ||
+    typeof state.Running !== 'boolean' ||
+    typeof state.Status !== 'string' ||
+    !isUnknownRecord(config) ||
+    (config.Labels !== null && config.Labels !== undefined && !isUnknownRecord(config.Labels))
+  ) {
+    throw new Error(
+      `Docker returned an invalid ObjectStorage identity for ${expectedContainerNameArg}.`,
+    );
+  }
+  const labels: Record<string, string> = {};
+  for (const [keyArg, valueArg] of Object.entries(config.Labels || {})) {
+    if (typeof valueArg !== 'string') {
+      throw new Error(
+        `Docker returned an invalid ObjectStorage identity for ${expectedContainerNameArg}.`,
+      );
+    }
+    labels[keyArg] = valueArg;
+  }
+  return {
+    id: inspected.Id,
+    name: normalizedName,
+    running: state.Running,
+    status: state.Status,
+    labels,
+  };
+};
+
+const parseObjectStorageInspection = (
   stdoutArg: string,
   expectedContainerNameArg: string,
-): IMinioContainerInspection => {
+): IObjectStorageContainerInspection => {
   let parsed: unknown;
   try {
     parsed = JSON.parse(stdoutArg);
   } catch {
-    throw new Error(`Docker returned an invalid MinIO inspection for ${expectedContainerNameArg}.`);
+    throw new Error(
+      `Docker returned an invalid ObjectStorage inspection for ${expectedContainerNameArg}.`,
+    );
   }
   if (!Array.isArray(parsed) || parsed.length !== 1 || !isUnknownRecord(parsed[0])) {
-    throw new Error(`Docker returned an invalid MinIO inspection for ${expectedContainerNameArg}.`);
+    throw new Error(
+      `Docker returned an invalid ObjectStorage inspection for ${expectedContainerNameArg}.`,
+    );
   }
 
   const inspected = parsed[0];
   const state = inspected.State;
   const config = inspected.Config;
   const hostConfig = inspected.HostConfig;
+  const healthcheck = isUnknownRecord(config) ? config.Healthcheck : undefined;
+  const restartPolicy = isUnknownRecord(hostConfig) ? hostConfig.RestartPolicy : undefined;
   const normalizedName =
     typeof inspected.Name === 'string' ? inspected.Name.replace(/^\//u, '') : undefined;
   if (
@@ -157,41 +306,88 @@ const parseMinioInspection = (
     normalizedName !== expectedContainerNameArg ||
     !isUnknownRecord(state) ||
     typeof state.Running !== 'boolean' ||
+    typeof state.Status !== 'string' ||
     !isUnknownRecord(config) ||
+    typeof config.Image !== 'string' ||
+    typeof config.User !== 'string' ||
+    !Array.isArray(config.Cmd) ||
+    !config.Cmd.every((entryArg) => typeof entryArg === 'string') ||
+    !Array.isArray(config.Entrypoint) ||
+    !config.Entrypoint.every((entryArg) => typeof entryArg === 'string') ||
     !isUnknownRecord(hostConfig) ||
     !isUnknownRecord(hostConfig.PortBindings) ||
+    !isUnknownRecord(restartPolicy) ||
+    typeof restartPolicy.Name !== 'string' ||
     !Array.isArray(config.Env) ||
-    !config.Env.every((entryArg) => typeof entryArg === 'string')
+    !config.Env.every((entryArg) => typeof entryArg === 'string') ||
+    !isUnknownRecord(config.Labels) ||
+    !isUnknownRecord(healthcheck) ||
+    !Array.isArray(healthcheck.Test) ||
+    !healthcheck.Test.every((entryArg) => typeof entryArg === 'string') ||
+    typeof healthcheck.Interval !== 'number' ||
+    typeof healthcheck.Timeout !== 'number' ||
+    typeof healthcheck.StartPeriod !== 'number' ||
+    typeof healthcheck.Retries !== 'number' ||
+    !Array.isArray(inspected.Mounts)
   ) {
-    throw new Error(`Docker returned an invalid MinIO inspection for ${expectedContainerNameArg}.`);
+    throw new Error(
+      `Docker returned an invalid ObjectStorage inspection for ${expectedContainerNameArg}.`,
+    );
   }
 
   const labels: Record<string, string> = {};
-  if (config.Labels !== null && config.Labels !== undefined) {
-    if (!isUnknownRecord(config.Labels)) {
-      throw new Error(`Docker returned an invalid MinIO inspection for ${expectedContainerNameArg}.`);
-    }
-    for (const [key, value] of Object.entries(config.Labels)) {
-      if (typeof value !== 'string') {
-        throw new Error(
-          `Docker returned an invalid MinIO inspection for ${expectedContainerNameArg}.`,
-        );
-      }
-      labels[key] = value;
+  for (const [key, value] of Object.entries(config.Labels)) {
+    if (typeof value !== 'string') {
+      throw new Error(
+        `Docker returned an invalid ObjectStorage inspection for ${expectedContainerNameArg}.`,
+      );
     }
+    labels[key] = value;
   }
+  const mounts = inspected.Mounts.map((mountArg) => {
+    if (
+      !isUnknownRecord(mountArg) ||
+      mountArg.Type !== 'bind' ||
+      typeof mountArg.Source !== 'string' ||
+      typeof mountArg.Destination !== 'string' ||
+      typeof mountArg.RW !== 'boolean'
+    ) {
+      throw new Error(
+        `Docker returned an invalid ObjectStorage inspection for ${expectedContainerNameArg}.`,
+      );
+    }
+    return {
+      source: plugins.path.resolve(mountArg.Source),
+      destination: mountArg.Destination,
+      readWrite: mountArg.RW,
+    };
+  });
 
   return {
     id: inspected.Id,
     name: normalizedName,
     running: state.Running,
+    status: state.Status,
+    image: config.Image,
     portBindings: hostConfig.PortBindings,
     environmentEntries: config.Env,
     labels,
+    mounts,
+    restartPolicy: restartPolicy.Name,
+    command: [...config.Cmd],
+    entrypoint: [...config.Entrypoint],
+    user: config.User,
+    healthcheck: {
+      test: [...healthcheck.Test],
+      interval: healthcheck.Interval,
+      timeout: healthcheck.Timeout,
+      startPeriod: healthcheck.StartPeriod,
+      retries: healthcheck.Retries,
+    },
   };
 };
 
-const minioPortMatches = (
+const objectStoragePortMatches = (
   portBindingsArg: Record<string, unknown>,
   containerPortArg: string,
   expectedHostPortArg: string,
@@ -199,106 +395,143 @@ const minioPortMatches = (
   const bindings = portBindingsArg[containerPortArg];
   return (
     Array.isArray(bindings) &&
-    bindings.some(
-      (bindingArg) =>
-        isUnknownRecord(bindingArg) && bindingArg.HostPort === expectedHostPortArg,
-    )
+    bindings.length === 1 &&
+    isUnknownRecord(bindings[0]) &&
+    bindings[0].HostIp === '127.0.0.1' &&
+    bindings[0].HostPort === expectedHostPortArg
   );
 };
 
-/** Converge a running MinIO container to an authenticated, verified bucket. */
-export const reconcileMinioBucket = async (
-  optionsArg: IMinioReconciliationOptions,
-): Promise<void> => {
-  if (!/^[a-f0-9]{64}$/u.test(optionsArg.containerId)) {
-    throw new Error('MinIO reconciliation requires a full immutable Docker container id.');
-  }
-  const clock = optionsArg.clock || defaultMinioClock;
-  const deadlineAt = optionsArg.deadlineAt ?? clock.now() + minioReconciliationTimeoutMs;
-  if (!Number.isFinite(deadlineAt)) {
-    throw new Error('MinIO reconciliation deadline must be finite');
+const isS3BucketNotFound = (errorArg: unknown): boolean => {
+  if (!isUnknownRecord(errorArg)) {
+    return false;
   }
+  const metadata = errorArg.$metadata;
+  return (
+    errorArg.name === 'NoSuchBucket' ||
+    errorArg.name === 'NotFound' ||
+    (isUnknownRecord(metadata) && metadata.httpStatusCode === 404)
+  );
+};
+
+/** Create the configured bucket only after an authenticated 404, then verify by HEAD. */
+export const reconcileObjectStorageBucket = async (
+  optionsArg: IObjectStorageBucketReconciliationOptions,
+): Promise<void> => {
+  const clock = optionsArg.clock || defaultObjectStorageClock;
+  const deadlineAt =
+    optionsArg.deadlineAt ?? clock.now() + objectStorageReconciliationTimeoutMs;
 
   const remainingMs = (): number => Math.floor(deadlineAt - clock.now());
-  const execOnce = async (
+  const sendWithDeadline = async (
     stageArg: string,
-    argvArg: readonly string[],
-    timeoutCapMsArg?: number,
-  ): Promise<IDockerExecArgvResult> => {
+    commandArg: plugins.s3.HeadBucketCommand | plugins.s3.CreateBucketCommand,
+  ): Promise<void> => {
     const remaining = remainingMs();
     if (remaining <= 0) {
-      throw minioStageError(stageArg, true);
+      throw objectStorageStageError(stageArg, true);
     }
+    const controller = new AbortController();
+    let timedOut = false;
+    const timeoutPromise = new Promise<never>((_resolve, reject) => {
+      const timer = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+        reject(objectStorageStageError(stageArg, true));
+      }, remaining);
+      controller.signal.addEventListener('abort', () => clearTimeout(timer), { once: true });
+    });
     try {
-      return await optionsArg.docker.execArgv(argvArg, {
-        timeoutMs: Math.max(
-          1,
-          timeoutCapMsArg === undefined ? remaining : Math.min(timeoutCapMsArg, remaining),
-        ),
-      });
+      await Promise.race([
+        optionsArg.smartBucket.storageClient.send(commandArg, {
+          abortSignal: controller.signal,
+        }),
+        timeoutPromise,
+      ]);
     } catch (error) {
-      throw minioStageError(stageArg, remainingMs() <= 0, error);
+      if (timedOut || error instanceof ObjectStorageStageError) {
+        throw objectStorageStageError(stageArg, true);
+      }
+      throw error;
+    } finally {
+      controller.abort();
     }
   };
-  const execUntilReady = async (
-    stageArg: string,
-    argvArg: readonly string[],
-  ): Promise<IDockerExecArgvResult> => {
-    let lastCause: unknown;
-    while (true) {
+
+  let primaryError: Error | undefined;
+  try {
+    if (!Number.isFinite(deadlineAt)) {
+      throw new Error('ObjectStorage reconciliation deadline must be finite.');
+    }
+    let bucketMissing = false;
+    try {
+      await sendWithDeadline(
+        'authenticated bucket lookup',
+        new plugins.s3.HeadBucketCommand({ Bucket: optionsArg.bucket }),
+      );
+    } catch (error) {
+      if (error instanceof ObjectStorageStageError) {
+        throw error;
+      }
+      if (!isS3BucketNotFound(error)) {
+        throw objectStorageStageError('authenticated bucket lookup', false);
+      }
+      bucketMissing = true;
+    }
+
+    let createFailed = false;
+    if (bucketMissing) {
       try {
-        return await execOnce(stageArg, argvArg, minioProbeTimeoutCapMs);
-      } catch (error) {
-        const currentCause = minioStageCause(error);
-        if (currentCause !== undefined) {
-          lastCause = currentCause;
-        }
-        const remaining = remainingMs();
-        if (remaining <= 0) {
-          throw minioStageError(stageArg, true, lastCause);
-        }
-        await clock.delay(Math.min(minioProbeIntervalMs, remaining));
-        if (remainingMs() <= 0) {
-          throw minioStageError(stageArg, true, lastCause);
-        }
+        await sendWithDeadline(
+          'bucket creation',
+          new plugins.s3.CreateBucketCommand({ Bucket: optionsArg.bucket }),
+        );
+      } catch {
+        // A timed-out or disconnected create can still have reached the server.
+        createFailed = true;
       }
     }
-  };
 
-  await execUntilReady('container readiness', ['exec', optionsArg.containerId, 'true']);
-  // The fixed script reads credentials only from the container environment.
-  await execUntilReady('alias configuration', [
-    'exec',
-    optionsArg.containerId,
-    'sh',
-    '-c',
-    minioAliasSetupScript,
-  ]);
-  await execUntilReady('authenticated readiness', [
-    'exec',
-    optionsArg.containerId,
-    'mc',
-    'ready',
-    '--json',
-    minioAlias,
-  ]);
-
-  const bucketTarget = `${minioAlias}/${optionsArg.bucket}`;
-  await execOnce('bucket creation', [
-    'exec',
-    optionsArg.containerId,
-    'mc',
-    'mb',
-    '--ignore-existing',
-    bucketTarget,
-  ]);
-  await execOnce('bucket verification', [
-    'exec',
-    optionsArg.containerId,
-    'mc',
-    'stat',
-    bucketTarget,
-  ]);
+    const verificationTimeout = Math.min(30_000, remainingMs());
+    if (verificationTimeout <= 0) {
+      throw objectStorageStageError('bucket verification', true);
+    }
+    let verification;
+    try {
+      verification = await optionsArg.smartBucket.checkReadiness(optionsArg.bucket, {
+        timeoutMs: verificationTimeout,
+      });
+    } catch {
+      throw objectStorageStageError('bucket verification', false);
+    }
+    if (!verification.ready) {
+      throw objectStorageStageError(
+        createFailed ? 'bucket creation and verification' : 'bucket verification',
+        verification.reason === 'timeout',
+      );
+    }
+  } catch (error) {
+    primaryError = normalizeObjectStorageLifecycleError(error);
+  }
+
+  let closeError: Error | undefined;
+  try {
+    await optionsArg.smartBucket.close();
+  } catch {
+    closeError = objectStorageStageError('S3 client cleanup', false);
+  }
+  if (primaryError && closeError) {
+    throw new AggregateError(
+      [primaryError, closeError],
+      'ObjectStorage bucket reconciliation failed and S3 client cleanup could not be confirmed.',
+    );
+  }
+  if (primaryError) {
+    throw primaryError;
+  }
+  if (closeError) {
+    throw closeError;
+  }
 };
 
 export class ServiceManager {
@@ -306,7 +539,17 @@ export class ServiceManager {
   private docker: DockerContainer;
   private enabledServices: string[] | null = null;
   private globalRegistry: GlobalRegistry;
-  private minioClock: IMinioReconciliationClock = defaultMinioClock;
+  private objectStorageClock: IObjectStorageReconciliationClock = defaultObjectStorageClock;
+  private fetchImplementation: typeof fetch = globalThis.fetch;
+  private smartBucketFactory = (configArg: IServiceConfig) =>
+    new plugins.smartbucket.SmartBucket({
+      endpoint: '127.0.0.1',
+      port: parseInt(configArg.S3_PORT),
+      useSsl: false,
+      region: configArg.S3_REGION,
+      accessKey: configArg.S3_ACCESSKEY,
+      accessSecret: configArg.S3_SECRETKEY,
+    });
 
   constructor() {
     this.config = new ServiceConfiguration();
@@ -317,7 +560,12 @@ export class ServiceManager {
   /**
    * Initialize the service manager
    */
-  public async init(): Promise<void> {
+  public async init(operationArg: TServiceManagerOperation): Promise<void> {
+    await runServiceMigrations({
+      projectPath: process.cwd(),
+      scopes: getServiceManagerMigrationScopes(operationArg),
+    });
+
     // Check Docker availability
     if (!(await this.docker.checkDocker())) {
       logger.log('error', 'Error: Docker is not installed. Please install Docker first.');
@@ -349,7 +597,9 @@ export class ServiceManager {
     // Any services command run in a project counts as activity. Without this
     // lastActive only advanced on start, so an actively used project could look
     // stale to the reaper.
-    await this.globalRegistry.touchProject(process.cwd());
+    await this.withProjectServiceLocks(process.cwd(), () =>
+      this.globalRegistry.touchProject(process.cwd()),
+    );
   }
 
   /**
@@ -379,11 +629,10 @@ export class ServiceManager {
    * Load service configuration from .smartconfig.json
    */
   private async loadServiceConfiguration(): Promise<void> {
-    const smartconfigInstance = new plugins.smartconfig.Smartconfig(process.cwd());
-    const gitzoneConfig = smartconfigInstance.dataFor<any>('@git.zone/cli', {});
+    const persistedServices = await readPersistedServiceConfiguration(process.cwd());
 
     // Check if services array exists
-    if (!gitzoneConfig.services || !Array.isArray(gitzoneConfig.services) || gitzoneConfig.services.length === 0) {
+    if (persistedServices.length === 0) {
       // Prompt user to select services
       const smartinteract = new plugins.smartinteract.SmartInteract();
       const response = await smartinteract.askQuestion({
@@ -392,21 +641,20 @@ export class ServiceManager {
         message: 'Which services do you want to enable for this project?',
         choices: [
           { name: 'MongoDB', value: 'mongodb' },
-          { name: 'MinIO (S3)', value: 'minio' },
+          { name: 'ObjectStorage (S3)', value: 'objectstorage' },
           { name: 'Elasticsearch', value: 'elasticsearch' }
         ],
-        default: ['mongodb', 'minio', 'elasticsearch']
+        default: ['mongodb', 'objectstorage', 'elasticsearch']
       });
 
-      const enabledServices = response.value || ['mongodb', 'minio', 'elasticsearch'];
+      const enabledServices = response.value || ['mongodb', 'objectstorage', 'elasticsearch'];
       this.enabledServices = enabledServices;
 
       // Save to .smartconfig.json
       await this.saveServiceConfiguration(enabledServices);
     } else {
-      const enabledServices = gitzoneConfig.services as string[];
-      this.enabledServices = enabledServices;
-      logger.log('info', `🔧 Enabled services: ${enabledServices.join(', ')}`);
+      this.enabledServices = persistedServices;
+      logger.log('info', `🔧 Enabled services: ${persistedServices.join(', ')}`);
     }
   }
 
@@ -414,26 +662,9 @@ export class ServiceManager {
    * Save service configuration to .smartconfig.json
    */
   private async saveServiceConfiguration(services: string[]): Promise<void> {
-    const smartconfigPath = plugins.path.join(process.cwd(), '.smartconfig.json');
-    let smartconfigData: any = {};
-
-    // Read existing .smartconfig.json if it exists
-    if (await plugins.smartfs.file(smartconfigPath).exists()) {
-      const content = await plugins.smartfs.file(smartconfigPath).encoding('utf8').read();
-      smartconfigData = JSON.parse(content as string);
-    }
-
-    // Update @git.zone/cli.services
-    if (!smartconfigData['@git.zone/cli']) {
-      smartconfigData['@git.zone/cli'] = {};
-    }
-    smartconfigData['@git.zone/cli'].services = services;
-
-    // Write back to .smartconfig.json
-    await plugins.smartfs
-      .file(smartconfigPath)
-      .encoding('utf8')
-      .write(JSON.stringify(smartconfigData, null, 2));
+    const smartconfigData = await readSmartconfigFile(process.cwd());
+    setCliConfigValueInData(smartconfigData, 'services', services);
+    await writeSmartconfigFile(smartconfigData, process.cwd());
 
     logger.log('ok', `✅ Saved service configuration to .smartconfig.json`);
     logger.log('info', `🔧 Enabled services: ${services.join(', ')}`);
@@ -442,7 +673,7 @@ export class ServiceManager {
   /**
    * Check if a service is enabled
    */
-  private isServiceEnabled(service: string): boolean {
+  public isServiceEnabled(service: TServiceName): boolean {
     if (!this.enabledServices) {
       return true; // If no configuration, enable all
     }
@@ -459,8 +690,14 @@ export class ServiceManager {
     serviceArg: TServiceName,
     dataPathArg: string,
   ): Promise<{ [key: string]: string }> {
-    await plugins.smartfs.directory(dataPathArg).recursive().create();
-    await recordServiceDataDirectory(process.cwd(), serviceArg);
+    if (await plugins.smartfs.directory(dataPathArg).exists()) {
+      await recordServiceDataDirectory(process.cwd(), serviceArg);
+    } else {
+      // Publish ownership first: interruption can leave an absent directory with
+      // a harmless claim, but never an unmarked directory that blocks recovery.
+      await recordServiceDataDirectory(process.cwd(), serviceArg);
+      await this.createDataDirectory(dataPathArg);
+    }
     return getServiceContainerLabels({
       projectPath: process.cwd(),
       service: serviceArg,
@@ -468,6 +705,10 @@ export class ServiceManager {
     });
   }
 
+  private async createDataDirectory(dataPathArg: string): Promise<void> {
+    await plugins.smartfs.directory(dataPathArg).recursive().create();
+  }
+
   /**
    * Register this project with the global registry.
    *
@@ -484,16 +725,16 @@ export class ServiceManager {
       projectName: config.PROJECT_NAME,
       containers: {
         mongo: containers.mongo,
-        minio: containers.minio,
+        objectstorage: containers.objectstorage,
         elasticsearch: containers.elasticsearch,
       },
       ports: {
         mongo: parseInt(config.MONGODB_PORT),
         s3: parseInt(config.S3_PORT),
-        s3Console: parseInt(config.S3_CONSOLE_PORT),
+        s3Ui: parseInt(config.S3_UI_PORT),
         elasticsearch: parseInt(config.ELASTICSEARCH_PORT),
       },
-      enabledServices: this.enabledServices || ['mongodb', 'minio', 'elasticsearch'],
+      enabledServices: this.enabledServices || ['mongodb', 'objectstorage', 'elasticsearch'],
     });
   }
 
@@ -507,9 +748,9 @@ export class ServiceManager {
       await this.startMongoDB();
       first = false;
     }
-    if (this.isServiceEnabled('minio')) {
+    if (this.isServiceEnabled('objectstorage')) {
       if (!first) console.log();
-      await this.startMinIO();
+      await this.startObjectStorage();
       first = false;
     }
     if (this.isServiceEnabled('elasticsearch')) {
@@ -530,7 +771,7 @@ export class ServiceManager {
   public async stopAll(): Promise<void> {
     await this.stopMongoDB();
     console.log();
-    await this.stopMinIO();
+    await this.stopObjectStorage();
     console.log();
     await this.stopElasticsearch();
   }
@@ -544,6 +785,28 @@ export class ServiceManager {
    * (localhost:MONGODB_PORT) is reachable from host and container alike.
    */
   public async startMongoDB(): Promise<void> {
+    await withServiceDataOperationLock(process.cwd(), 'mongodb', () =>
+      this.startMongoDBLocked(),
+    );
+  }
+
+  private async assertNoPendingDataDeletion(serviceArg: TServiceName): Promise<void> {
+    const pendingPath = await this.docker.getPendingDataDeletionPath(
+      process.cwd(),
+      serviceArg,
+    );
+    if (pendingPath) {
+      throw new Error(
+        `Pending ${serviceArg} data deletion must finish before startup: ${pendingPath}. ` +
+          'Run `gitzone services clean --yes` to resume the recorded cleanup.',
+      );
+    }
+  }
+
+  private async startMongoDBLocked(): Promise<void> {
+    await this.config.reloadFromDisk();
+    await this.assertNoPendingDataDeletion('mongodb');
+    await this.globalRegistry.touchProject(process.cwd());
     logger.log('note', '📦 MongoDB:');
 
     const config = this.config.getConfig();
@@ -846,107 +1109,291 @@ export class ServiceManager {
     return false;
   }
 
-  private async inspectMinioContainer(
+  private async inspectObjectStorageContainer(
     containerReferenceArg: string,
     expectedContainerNameArg: string,
     dockerTimeoutArg: () => { timeoutMs: number },
-  ): Promise<IMinioContainerInspection> {
+  ): Promise<IObjectStorageContainerInspection> {
     const result = await this.docker.execArgv(
       ['inspect', containerReferenceArg],
       dockerTimeoutArg(),
     );
-    return parseMinioInspection(result.stdout, expectedContainerNameArg);
+    return parseObjectStorageInspection(result.stdout, expectedContainerNameArg);
   }
 
-  private async assertMinioOwnership(
-    inspectionArg: IMinioContainerInspection,
-    expectedLabelsArg: Record<string, string>,
-    allowLegacyRegistryArg: boolean,
-  ): Promise<void> {
-    const actualGitZoneLabels = Object.entries(inspectionArg.labels).filter(([key]) =>
-      key.startsWith('git.zone.'),
+  private async inspectObjectStorageIdentity(
+    containerReferenceArg: string,
+    expectedContainerNameArg: string,
+    dockerTimeoutArg: () => { timeoutMs: number },
+  ): Promise<IObjectStorageContainerIdentity> {
+    const result = await this.docker.execArgv(
+      ['inspect', containerReferenceArg],
+      dockerTimeoutArg(),
     );
-    const expectedEntries = Object.entries(expectedLabelsArg);
-    const hasExactCurrentLabels =
-      actualGitZoneLabels.length === expectedEntries.length &&
-      expectedEntries.every(([key, value]) => inspectionArg.labels[key] === value);
-    if (hasExactCurrentLabels) {
-      return;
-    }
-
-    const refusal = (): Error =>
-      new Error(
-        `Refusing to use MinIO container ${inspectionArg.name}: ` +
-          'its ownership is not proven for the current project.',
+    const identity = parseObjectStorageIdentity(result.stdout, expectedContainerNameArg);
+    if (/^[a-f0-9]{64}$/u.test(containerReferenceArg) && identity.id !== containerReferenceArg) {
+      throw new Error(
+        `Refusing ObjectStorage container ${expectedContainerNameArg}: its immutable id changed.`,
       );
-
-    if (!allowLegacyRegistryArg) {
-      throw refusal();
-    }
-
-    // Any ownership label is authoritative. A partial, stale, or foreign set
-    // must never be reinterpreted through the legacy registry fallback.
-    if (actualGitZoneLabels.length > 0 || Object.keys(inspectionArg.labels).length > 0) {
-      throw refusal();
     }
+    return identity;
+  }
 
-    // Containers created before labels were introduced may be reclaimed only
-    // when the old global registry has one unambiguous claim for this exact
-    // name and the current resolved project path.
-    const currentProjectPath = plugins.path.resolve(process.cwd());
-    const registryProjects = await this.globalRegistry.getAllProjects();
-    const claims = Object.entries(registryProjects).filter(
-      ([, project]) => project.containers.minio === inspectionArg.name,
+  private async discoverContainerIdByExactName(
+    containerNameArg: string,
+    dockerTimeoutArg: () => { timeoutMs: number },
+  ): Promise<string | undefined> {
+    const result = await this.docker.execArgv(
+      [
+        'container',
+        'ls',
+        '-a',
+        '--no-trunc',
+        '--filter',
+        `name=^/${containerNameArg}$`,
+        '--format',
+        '{{.ID}}',
+      ],
+      dockerTimeoutArg(),
     );
-    if (claims.length !== 1) {
-      throw refusal();
+    const ids = result.stdout
+      .split(/\r?\n/u)
+      .map((entry) => entry.trim())
+      .filter(Boolean);
+    if (ids.length === 0) {
+      return undefined;
     }
-    const [registryPath, project] = claims[0];
-    if (
-      plugins.path.resolve(registryPath) !== currentProjectPath ||
-      plugins.path.resolve(project.projectPath) !== currentProjectPath
-    ) {
-      throw refusal();
+    if (ids.length !== 1 || !/^[a-f0-9]{64}$/u.test(ids[0])) {
+      throw new Error(`Docker returned ambiguous identity for container ${containerNameArg}.`);
     }
+    return ids[0];
   }
 
-  private async revalidateMinioContainer(
+  private assertObjectStorageOwnership(
+    inspectionArg: IObjectStorageContainerInspection,
+    expectedLabelsArg: Record<string, string>,
+  ): void {
+    if (!hasExactServiceContainerLabels(inspectionArg.labels, expectedLabelsArg)) {
+      throw new Error(
+        `Refusing to use ObjectStorage container ${inspectionArg.name}: ` +
+          'its ownership is not proven for the current project.',
+      );
+    }
+  }
+
+  private async revalidateObjectStorageContainer(
     containerIdArg: string,
     expectedContainerNameArg: string,
     expectedLabelsArg: Record<string, string>,
-    allowLegacyRegistryArg: boolean,
     dockerTimeoutArg: () => { timeoutMs: number },
-  ): Promise<IMinioContainerInspection> {
-    const inspection = await this.inspectMinioContainer(
+  ): Promise<IObjectStorageContainerInspection> {
+    const inspection = await this.inspectObjectStorageContainer(
       containerIdArg,
       expectedContainerNameArg,
       dockerTimeoutArg,
     );
     if (inspection.id !== containerIdArg) {
       throw new Error(
-        `Refusing to use MinIO container ${expectedContainerNameArg}: ` +
+        `Refusing to use ObjectStorage container ${expectedContainerNameArg}: ` +
           'its immutable id changed during reconciliation.',
       );
     }
-    await this.assertMinioOwnership(
-      inspection,
-      expectedLabelsArg,
-      allowLegacyRegistryArg,
-    );
+    this.assertObjectStorageOwnership(inspection, expectedLabelsArg);
     return inspection;
   }
-  
-  /**
-   * Start MinIO service
-   */
-  public async startMinIO(): Promise<void> {
-    logger.log('note', '📦 S3/MinIO:');
 
+  private objectStorageConfigurationMatches(
+    inspectionArg: IObjectStorageContainerInspection,
+    expectedLabelsArg: Record<string, string>,
+  ): boolean {
     const config = this.config.getConfig();
-    const containers = this.config.getContainerNames();
     const directories = this.config.getDataDirectories();
+    const expectedEnvironment: Record<string, string> = {
+      OBJST_PORT: '9000',
+      UI_PORT: '3000',
+      OBJST_STORAGE_DIR: '/data',
+      OBJST_ACCESS_KEY: config.S3_ACCESSKEY,
+      OBJST_SECRET_KEY: config.S3_SECRETKEY,
+      OBJST_ADMIN_PASSWORD: config.S3_ADMIN_PASSWORD,
+      OBJST_REGION: config.S3_REGION,
+    };
+    const controlledEnvironmentEntries = inspectionArg.environmentEntries.filter((entryArg) => {
+      const separatorIndex = entryArg.indexOf('=');
+      const name = separatorIndex === -1 ? entryArg : entryArg.slice(0, separatorIndex);
+      return name === 'UI_PORT' || name.startsWith('OBJST_');
+    });
+    const readEnvironment = (nameArg: string): string | undefined => {
+      const prefix = `${nameArg}=`;
+      const matches = inspectionArg.environmentEntries.filter((entry) =>
+        entry.startsWith(prefix),
+      );
+      return matches.length === 1 ? matches[0].slice(prefix.length) : undefined;
+    };
+    const portKeys = Object.keys(inspectionArg.portBindings).sort();
+    const expectedPortKeys = ['3000/tcp', '9000/tcp'];
+    const healthcheckMatches =
+      inspectionArg.healthcheck.test.length === objectStorageExpectedHealthcheck.test.length &&
+      inspectionArg.healthcheck.test.every(
+        (entry, index) => entry === objectStorageExpectedHealthcheck.test[index],
+      ) &&
+      inspectionArg.healthcheck.interval === objectStorageExpectedHealthcheck.interval &&
+      inspectionArg.healthcheck.timeout === objectStorageExpectedHealthcheck.timeout &&
+      inspectionArg.healthcheck.startPeriod === objectStorageExpectedHealthcheck.startPeriod &&
+      inspectionArg.healthcheck.retries === objectStorageExpectedHealthcheck.retries;
+    return (
+      inspectionArg.image === objectStorageImage &&
+      portKeys.length === expectedPortKeys.length &&
+      portKeys.every((entry, index) => entry === expectedPortKeys[index]) &&
+      objectStoragePortMatches(inspectionArg.portBindings, '9000/tcp', config.S3_PORT) &&
+      objectStoragePortMatches(inspectionArg.portBindings, '3000/tcp', config.S3_UI_PORT) &&
+      inspectionArg.mounts.length === 1 &&
+      inspectionArg.mounts[0].source === plugins.path.resolve(directories.objectstorage) &&
+      inspectionArg.mounts[0].destination === '/data' &&
+      inspectionArg.mounts[0].readWrite &&
+      controlledEnvironmentEntries.length === Object.keys(expectedEnvironment).length &&
+      Object.entries(expectedEnvironment).every(
+        ([name, value]) => readEnvironment(name) === value,
+      ) &&
+      hasExactServiceContainerLabels(inspectionArg.labels, expectedLabelsArg) &&
+      inspectionArg.restartPolicy === 'unless-stopped' &&
+      inspectionArg.command.length === objectStorageExpectedCommand.length &&
+      inspectionArg.command.every(
+        (entry, index) => entry === objectStorageExpectedCommand[index],
+      ) &&
+      inspectionArg.entrypoint.length === objectStorageExpectedEntrypoint.length &&
+      inspectionArg.entrypoint.every(
+        (entry, index) => entry === objectStorageExpectedEntrypoint[index],
+      ) &&
+      inspectionArg.user === 'objectstorage' &&
+      healthcheckMatches
+    );
+  }
+
+  private async assertNoSymlinkedObjectStoragePath(dataPathArg: string): Promise<void> {
+    const projectPath = plugins.path.resolve(process.cwd());
+    const expectedPath = getServiceDataDirectory(projectPath, 'objectstorage');
+    if (plugins.path.resolve(dataPathArg) !== expectedPath) {
+      throw new Error(`Refusing non-canonical ObjectStorage data path: ${dataPathArg}`);
+    }
+    for (const candidate of [projectPath, plugins.path.join(projectPath, '.nogit'), expectedPath]) {
+      try {
+        if ((await plugins.fs.lstat(candidate)).isSymbolicLink()) {
+          throw new Error(`Refusing symbolic-link ObjectStorage path component: ${candidate}`);
+        }
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+          throw error;
+        }
+      }
+    }
+  }
 
-    // Validation lives on the mutating path so recovery commands remain usable.
+  private async prepareObjectStorageDataDirectory(
+    dockerTimeoutArg: () => { timeoutMs: number },
+  ): Promise<Record<string, string>> {
+    const projectPath = plugins.path.resolve(process.cwd());
+    const dataPath = this.config.getDataDirectories().objectstorage;
+    await this.assertNoSymlinkedObjectStoragePath(dataPath);
+    const exists = await plugins.smartfs.directory(dataPath).exists();
+    const marker = await readServiceDataMarker(projectPath);
+    if (exists && !markerProvesServiceDataDirectory(marker, projectPath, 'objectstorage')) {
+      throw new Error(
+        `Refusing existing ObjectStorage data directory with unproven ownership: ${dataPath}`,
+      );
+    }
+    if (!exists) {
+      await recordServiceDataDirectory(projectPath, 'objectstorage');
+      await this.createDataDirectory(dataPath);
+    }
+
+    const labels = getServiceContainerLabels({
+      projectPath,
+      service: 'objectstorage',
+      dataPath,
+    });
+    await this.docker.runFencedBindOperation({
+      image: objectStorageImage,
+      hostPath: dataPath,
+      containerPath: '/data',
+      entrypoint: '/bin/chown',
+      command: ['-R', 'objectstorage:objectstorage', '/data'],
+      labels: {
+        'git.zone.tool': serviceToolLabel,
+        'git.zone.service': 'objectstorage',
+        'git.zone.project-path': projectPath,
+        'git.zone.data-path': plugins.path.resolve(dataPath),
+        'git.zone.safe-to-prune': 'false',
+        [serviceOperationLabel]: serviceBindOperation,
+      },
+      executionOptions: dockerTimeoutArg,
+      rollbackTimeoutMs: objectStorageRollbackTimeoutMs,
+    });
+    return labels;
+  }
+
+  private async repairObjectStorageMarkerFromOwnedContainer(dataPathArg: string): Promise<void> {
+    const projectPath = plugins.path.resolve(process.cwd());
+    await this.assertNoSymlinkedObjectStoragePath(dataPathArg);
+    if (!(await plugins.smartfs.directory(dataPathArg).exists())) {
+      throw new Error(
+        `Refusing owned ObjectStorage container with a missing data directory: ${dataPathArg}`,
+      );
+    }
+    const marker = await readServiceDataMarker(projectPath);
+    if (!markerProvesServiceDataDirectory(marker, projectPath, 'objectstorage')) {
+      // recordServiceDataDirectory rejects an invalid/foreign marker, so only an
+      // absent or valid mergeable claim is repaired from exact container labels.
+      await recordServiceDataDirectory(projectPath, 'objectstorage');
+    }
+  }
+
+  private async assertNoLegacyMinioResources(
+    dockerTimeoutArg: () => { timeoutMs: number },
+  ): Promise<void> {
+    const projectPath = plugins.path.resolve(process.cwd());
+    const containers = this.config.getContainerNames();
+    const projects = await this.globalRegistry.getAllProjects();
+    const registryEntry = Object.entries(projects).find(
+      ([registeredPath]) => plugins.path.resolve(registeredPath) === projectPath,
+    )?.[1];
+    const candidateNames = new Set<string>([containers.legacyMinio]);
+    if (registryEntry?.legacy?.minioContainer) {
+      candidateNames.add(registryEntry.legacy.minioContainer);
+    }
+    const existingContainers: string[] = [];
+    for (const candidateName of candidateNames) {
+      if (await this.discoverContainerIdByExactName(candidateName, dockerTimeoutArg)) {
+        existingContainers.push(candidateName);
+      }
+    }
+    const legacyDataPath = getLegacyMinioDataDirectory(projectPath);
+    const legacyDataExists = await plugins.smartfs.directory(legacyDataPath).exists();
+    if (existingContainers.length === 0 && !legacyDataExists) {
+      return;
+    }
+
+    const evidence = [
+      ...existingContainers.map((name) => `container ${name}`),
+      ...(legacyDataExists ? [`data directory ${legacyDataPath}`] : []),
+    ].join(', ');
+    throw new Error(
+      `Legacy MinIO state blocks ObjectStorage startup: ${evidence}. ` +
+        'GitZone will not start, stop, remove, or reuse these resources because their disk layout is not compatible with SmartStorage. ' +
+        'Recovery: (1) export the required bucket data with your existing legacy tooling; ' +
+        '(2) stop and rename the legacy container and move .nogit/miniodata to a preserved backup location; ' +
+        '(3) run `gitzone services start s3`; ' +
+        '(4) import the backup with an external S3 client and verify every required object before disposing of the legacy backup.',
+    );
+  }
+
+  /** Read-only preflight used before restart or reconfigure may stop anything. */
+  public async assertObjectStorageStartupAllowed(): Promise<void> {
+    this.assertObjectStorageConfigurationSafe();
+    await this.assertNoLegacyMinioResources(() => ({ timeoutMs: 60_000 }));
+  }
+
+  private assertObjectStorageConfigurationSafe(): void {
+    const config = this.config.getConfig();
     const bucketValidationError = getS3BucketNameValidationError(config.S3_BUCKET);
     if (bucketValidationError) {
       throw new Error(
@@ -954,156 +1401,277 @@ export class ServiceManager {
           'Choose a valid custom bucket name or remove the field to regenerate the project default.',
       );
     }
+    this.config.assertObjectStorageCredentialsAreSafe();
+  }
 
-    // Ensure data directory exists and is marked as tool-owned
-    const minioLabels = await this.prepareDataDirectory('minio', directories.minio);
-    const deadlineAt = this.minioClock.now() + minioReconciliationTimeoutMs;
+  private async waitForObjectStorageReadiness(
+    configArg: IServiceConfig,
+    deadlineAtArg: number,
+  ): Promise<void> {
+    while (true) {
+      const remaining = Math.floor(deadlineAtArg - this.objectStorageClock.now());
+      if (remaining <= 0) {
+        throw objectStorageStageError('management readiness', true);
+      }
+      const controller = new AbortController();
+      const probeTimeoutMs = Math.max(
+        1,
+        Math.min(objectStorageProbeTimeoutCapMs, remaining),
+      );
+      let probeTimedOut = false;
+      let timer: NodeJS.Timeout | undefined;
+      const fetchPromise = this.fetchImplementation(
+        `http://127.0.0.1:${configArg.S3_UI_PORT}/readyz`,
+        { signal: controller.signal },
+      );
+      const timeoutPromise = new Promise<never>((_resolve, reject) => {
+        timer = setTimeout(() => {
+          probeTimedOut = true;
+          controller.abort();
+          reject(objectStorageStageError('management readiness', true));
+        }, probeTimeoutMs);
+      });
+      try {
+        const response = await Promise.race([fetchPromise, timeoutPromise]);
+        const ready = response.ok;
+        controller.abort();
+        if (response.body) {
+          void response.body.cancel().catch(() => {});
+        }
+        if (ready) {
+          return;
+        }
+      } catch {
+        // Startup commonly refuses connections before the management listener binds.
+      } finally {
+        if (timer) {
+          clearTimeout(timer);
+        }
+        controller.abort();
+        if (probeTimedOut) {
+          // A non-cooperative fetch may resolve after the timeout race. Consume
+          // that late response as well so its body cannot retain a connection.
+          void fetchPromise.then(
+            (responseArg) => {
+              if (responseArg.body) {
+                void responseArg.body.cancel().catch(() => {});
+              }
+            },
+            () => {},
+          );
+        }
+      }
+      const afterProbe = Math.floor(deadlineAtArg - this.objectStorageClock.now());
+      if (afterProbe <= 0) {
+        throw objectStorageStageError('management readiness', true);
+      }
+      await this.objectStorageClock.delay(
+        Math.min(objectStorageProbeIntervalMs, afterProbe),
+      );
+    }
+  }
+
+  private async createObjectStorageContainer(
+    labelsArg: Record<string, string>,
+    dockerTimeoutArg: () => { timeoutMs: number },
+  ): Promise<IObjectStorageContainerInspection> {
+    const config = this.config.getConfig();
+    const containers = this.config.getContainerNames();
+    const directories = this.config.getDataDirectories();
+    const creationResult = await this.docker.createArgv(
+      {
+        name: containers.objectstorage,
+        image: objectStorageImage,
+        ports: {
+          [`127.0.0.1:${config.S3_PORT}`]: '9000',
+          [`127.0.0.1:${config.S3_UI_PORT}`]: '3000',
+        },
+        volumes: { [directories.objectstorage]: '/data' },
+        environment: {
+          OBJST_PORT: '9000',
+          UI_PORT: '3000',
+          OBJST_STORAGE_DIR: '/data',
+          OBJST_ACCESS_KEY: config.S3_ACCESSKEY,
+          OBJST_SECRET_KEY: config.S3_SECRETKEY,
+          OBJST_ADMIN_PASSWORD: config.S3_ADMIN_PASSWORD,
+          OBJST_REGION: config.S3_REGION,
+        },
+        labels: labelsArg,
+        restart: 'unless-stopped',
+      },
+      dockerTimeoutArg(),
+    );
+    const containerId = creationResult.stdout.trim();
+    if (!/^[a-f0-9]{64}$/u.test(containerId)) {
+      throw new Error(`Docker returned an invalid id while creating ${containers.objectstorage}.`);
+    }
+    const inspection = await this.revalidateObjectStorageContainer(
+      containerId,
+      containers.objectstorage,
+      labelsArg,
+      dockerTimeoutArg,
+    );
+    if (inspection.running || inspection.status !== 'created') {
+      throw new Error(`ObjectStorage container ${containers.objectstorage} was not created stopped.`);
+    }
+    if (!this.objectStorageConfigurationMatches(inspection, labelsArg)) {
+      throw new Error(
+        `ObjectStorage container ${containers.objectstorage} does not match the required runtime configuration.`,
+      );
+    }
+    return inspection;
+  }
+
+  /** Start or reconcile the canonical ObjectStorage service. */
+  public async startObjectStorage(): Promise<void> {
+    await withServiceDataOperationLock(process.cwd(), 'objectstorage', () =>
+      this.startObjectStorageLocked(),
+    );
+  }
+
+  private async startObjectStorageLocked(): Promise<void> {
+    await this.config.reloadFromDisk();
+    await this.assertNoPendingDataDeletion('objectstorage');
+    await this.globalRegistry.touchProject(process.cwd());
+    logger.log('note', '📦 S3/ObjectStorage:');
+
+    const config = this.config.getConfig();
+    const containers = this.config.getContainerNames();
+    const directories = this.config.getDataDirectories();
+    this.assertObjectStorageConfigurationSafe();
+
+    const deadlineAt =
+      this.objectStorageClock.now() + objectStorageReconciliationTimeoutMs;
     const dockerTimeout = (): { timeoutMs: number } => {
-      const remaining = Math.floor(deadlineAt - this.minioClock.now());
+      const remaining = Math.floor(deadlineAt - this.objectStorageClock.now());
       if (remaining <= 0) {
-        throw new Error(
-          'MinIO container setup did not complete before the shared reconciliation deadline.',
-        );
+        throw objectStorageStageError('container setup', true);
       }
       return { timeoutMs: Math.max(1, remaining) };
     };
-
+    const expectedLabels = getServiceContainerLabels({
+      projectPath: process.cwd(),
+      service: 'objectstorage',
+      dataPath: directories.objectstorage,
+    });
     const startedContainerIds: string[] = [];
-    const startById = async (containerIdArg: string): Promise<void> => {
+    const startById = async (
+      containerIdArg: string,
+      ownedByInvocationArg: boolean,
+    ): Promise<void> => {
       const executionOptions = dockerTimeout();
-      // Record ownership of the lifecycle before awaiting Docker: a timed-out
-      // start may still have reached the daemon and must be rolled back.
-      startedContainerIds.push(containerIdArg);
+      if (ownedByInvocationArg) {
+        startedContainerIds.push(containerIdArg);
+      }
       await this.docker.execArgv(['start', containerIdArg], executionOptions);
+      if (!ownedByInvocationArg) {
+        startedContainerIds.push(containerIdArg);
+      }
     };
 
     let outcome: string;
     try {
-      const listResult = await this.docker.execArgv(
-        [
-          'container',
-          'ls',
-          '-a',
-          '--filter',
-          `name=${containers.minio}`,
-          '--format',
-          '{{.Names}}',
-        ],
-        dockerTimeout(),
+      await this.assertNoLegacyMinioResources(dockerTimeout);
+
+      const existingId = await this.discoverContainerIdByExactName(
+        containers.objectstorage,
+        dockerTimeout,
       );
-      const containerExists = listResult.stdout
-        .split(/\r?\n/u)
-        .map((lineArg) => lineArg.trim())
-        .includes(containers.minio);
-
-      let initialInspection: IMinioContainerInspection | undefined;
-      if (containerExists) {
-        initialInspection = await this.inspectMinioContainer(
-          containers.minio,
-          containers.minio,
+      let initialInspection: IObjectStorageContainerInspection | undefined;
+      if (existingId) {
+        initialInspection = await this.inspectObjectStorageContainer(
+          existingId,
+          containers.objectstorage,
           dockerTimeout,
         );
-        // No existing container is started or receives an in-container command
-        // until it proves current or unambiguous legacy ownership.
-        await this.assertMinioOwnership(initialInspection, minioLabels, true);
+        this.assertObjectStorageOwnership(initialInspection, expectedLabels);
+        await this.repairObjectStorageMarkerFromOwnedContainer(directories.objectstorage);
+      } else {
+        await this.config.validateObjectStoragePorts();
       }
 
-      let needsRecreate = false;
-      let credentialsChanged = false;
-      if (initialInspection) {
-        const apiMatches = minioPortMatches(
-          initialInspection.portBindings,
-          '9000/tcp',
-          config.S3_PORT,
-        );
-        const consoleMatches = minioPortMatches(
-          initialInspection.portBindings,
-          '9001/tcp',
-          config.S3_CONSOLE_PORT,
-        );
-        const readExactEnvironmentValue = (nameArg: string): string | undefined => {
-          const prefix = `${nameArg}=`;
-          const matches = initialInspection.environmentEntries.filter((entryArg) =>
-            entryArg.startsWith(prefix),
+      const needsRecreate =
+        !!initialInspection &&
+        !this.objectStorageConfigurationMatches(initialInspection, expectedLabels);
+      let activeInspection: IObjectStorageContainerInspection;
+      if (!initialInspection || needsRecreate) {
+        const labels = await this.prepareObjectStorageDataDirectory(dockerTimeout);
+        if (initialInspection) {
+          logger.log('note', '  Runtime configuration changed, recreating container...');
+          await this.revalidateObjectStorageContainer(
+            initialInspection.id,
+            containers.objectstorage,
+            expectedLabels,
+            dockerTimeout,
           );
-          return matches.length === 1 ? matches[0].slice(prefix.length) : undefined;
-        };
-        credentialsChanged =
-          readExactEnvironmentValue('MINIO_ROOT_USER') !== config.S3_ACCESSKEY ||
-          readExactEnvironmentValue('MINIO_ROOT_PASSWORD') !== config.S3_SECRETKEY;
-        needsRecreate = !apiMatches || !consoleMatches || credentialsChanged;
-      }
-
-      let activeInspection: IMinioContainerInspection;
-      let activeAllowsLegacyRegistry: boolean;
-      if (initialInspection && needsRecreate) {
-        logger.log(
-          'note',
-          credentialsChanged
-            ? '  Credential configuration changed, recreating container...'
-            : '  Port configuration changed, recreating container...',
-        );
-        await this.revalidateMinioContainer(
-          initialInspection.id,
-          containers.minio,
-          minioLabels,
-          true,
-          dockerTimeout,
-        );
-        await this.docker.execArgv(['rm', '-f', initialInspection.id], dockerTimeout());
-        activeInspection = await this.createMinioContainer(minioLabels, dockerTimeout);
-        activeAllowsLegacyRegistry = false;
-        await startById(activeInspection.id);
-        outcome = 'Recreated with configured ports and reconciled';
-      } else if (initialInspection && !initialInspection.running) {
+          await this.docker.execArgv(['rm', '-f', initialInspection.id], dockerTimeout());
+        } else {
+          logger.log('note', '  Creating container...');
+        }
+        activeInspection = await this.createObjectStorageContainer(labels, dockerTimeout);
+        await startById(activeInspection.id, true);
+        outcome = initialInspection
+          ? 'Recreated with canonical configuration and reconciled'
+          : 'Created, started, and reconciled';
+      } else if (!initialInspection.running) {
         logger.log('note', '  Starting existing container...');
         activeInspection = initialInspection;
-        activeAllowsLegacyRegistry = true;
-        await startById(activeInspection.id);
+        await startById(activeInspection.id, false);
         outcome = 'Started and reconciled';
-      } else if (!initialInspection) {
-        logger.log('note', '  Creating container...');
-        activeInspection = await this.createMinioContainer(minioLabels, dockerTimeout);
-        activeAllowsLegacyRegistry = false;
-        await startById(activeInspection.id);
-        outcome = 'Created, started, and reconciled';
       } else {
         logger.log('note', '  Already running; reconciling bucket...');
         activeInspection = initialInspection;
-        activeAllowsLegacyRegistry = true;
         outcome = 'Already running and reconciled';
       }
 
-      const reconciliationInspection = await this.revalidateMinioContainer(
+      await this.revalidateObjectStorageContainer(
         activeInspection.id,
-        containers.minio,
-        minioLabels,
-        activeAllowsLegacyRegistry,
+        containers.objectstorage,
+        expectedLabels,
         dockerTimeout,
       );
-      await reconcileMinioBucket({
-        docker: this.docker,
-        containerId: reconciliationInspection.id,
+      await this.waitForObjectStorageReadiness(config, deadlineAt);
+      await reconcileObjectStorageBucket({
+        smartBucket: this.smartBucketFactory(config),
         bucket: config.S3_BUCKET,
         deadlineAt,
-        clock: this.minioClock,
+        clock: this.objectStorageClock,
       });
+      const finalInspection = await this.revalidateObjectStorageContainer(
+        activeInspection.id,
+        containers.objectstorage,
+        expectedLabels,
+        dockerTimeout,
+      );
+      if (!finalInspection.running) {
+        throw new Error(
+          `ObjectStorage container ${containers.objectstorage} stopped during reconciliation.`,
+        );
+      }
     } catch (error) {
-      const originalError = normalizeMinioLifecycleError(error);
+      const originalError = normalizeObjectStorageLifecycleError(error);
       const rollbackErrors: Error[] = [];
       for (let index = startedContainerIds.length - 1; index >= 0; index--) {
         try {
-          await this.docker.execArgv(['stop', startedContainerIds[index]], {
-            timeoutMs: minioRollbackTimeoutMs,
-          });
+          const rollbackInspection = await this.revalidateObjectStorageContainer(
+            startedContainerIds[index],
+            containers.objectstorage,
+            expectedLabels,
+            () => ({ timeoutMs: objectStorageRollbackTimeoutMs }),
+          );
+          if (rollbackInspection.running) {
+            await this.docker.execArgv(['stop', startedContainerIds[index]], {
+              timeoutMs: objectStorageRollbackTimeoutMs,
+            });
+          }
         } catch (rollbackError) {
-          rollbackErrors.push(normalizeMinioLifecycleError(rollbackError));
+          rollbackErrors.push(normalizeObjectStorageLifecycleError(rollbackError));
         }
       }
       if (rollbackErrors.length > 0) {
         throw new AggregateError(
           [originalError, ...rollbackErrors],
-          'MinIO startup failed and rollback could not stop every container started by this invocation.',
+          'ObjectStorage startup failed and rollback could not stop every container started by this invocation.',
         );
       }
       throw originalError;
@@ -1111,68 +1679,25 @@ export class ServiceManager {
 
     logger.log('ok', `  ${outcome} ✓`);
     logger.log('ok', `  Bucket '${config.S3_BUCKET}' exists and is authenticated ✓`);
-    logger.log('info', `  Container: ${containers.minio}`);
-    logger.log('info', `  Port: ${config.S3_PORT}`);
+    logger.log('info', `  Container: ${containers.objectstorage}`);
+    logger.log('info', `  S3 API: http://127.0.0.1:${config.S3_PORT}`);
     logger.log('info', `  Bucket: ${config.S3_BUCKET}`);
-    logger.log('info', `  API: http://${config.S3_HOST}:${config.S3_PORT}`);
-    logger.log(
-      'info',
-      `  Console: http://${config.S3_HOST}:${config.S3_CONSOLE_PORT} (credentials: ***)`,
-    );
-  }
-
-  /** Create stopped MinIO, inspect its id, and prove exact current labels. */
-  private async createMinioContainer(
-    labelsArg: { [key: string]: string },
-    dockerTimeoutArg: () => { timeoutMs: number },
-  ): Promise<IMinioContainerInspection> {
-    const config = this.config.getConfig();
-    const containers = this.config.getContainerNames();
-    const directories = this.config.getDataDirectories();
-    const creationResult = await this.docker.createArgv(
-      {
-        name: containers.minio,
-        image: 'minio/minio',
-        ports: {
-          [config.S3_PORT]: '9000',
-          [config.S3_CONSOLE_PORT]: '9001',
-        },
-        volumes: {
-          [directories.minio]: '/data',
-        },
-        environment: {
-          MINIO_ROOT_USER: config.S3_ACCESSKEY,
-          MINIO_ROOT_PASSWORD: config.S3_SECRETKEY,
-        },
-        labels: labelsArg,
-        restart: 'unless-stopped',
-        command: ['server', '/data', '--console-address', ':9001'],
-      },
-      dockerTimeoutArg(),
-    );
-    const containerId = creationResult.stdout.trim();
-    if (!/^[a-f0-9]{64}$/u.test(containerId)) {
-      throw new Error(`Docker returned an invalid id while creating ${containers.minio}.`);
-    }
-    const inspection = await this.inspectMinioContainer(
-      containerId,
-      containers.minio,
-      dockerTimeoutArg,
-    );
-    if (inspection.id !== containerId) {
-      throw new Error(
-        `Refusing to start MinIO container ${containers.minio}: ` +
-          'Docker inspection did not return the created immutable id.',
-      );
-    }
-    await this.assertMinioOwnership(inspection, labelsArg, false);
-    return inspection;
+    logger.log('info', `  Management UI: http://127.0.0.1:${config.S3_UI_PORT}`);
   }
 
   /**
    * Start Elasticsearch service
    */
   public async startElasticsearch(): Promise<void> {
+    await withServiceDataOperationLock(process.cwd(), 'elasticsearch', () =>
+      this.startElasticsearchLocked(),
+    );
+  }
+
+  private async startElasticsearchLocked(): Promise<void> {
+    await this.config.reloadFromDisk();
+    await this.assertNoPendingDataDeletion('elasticsearch');
+    await this.globalRegistry.touchProject(process.cwd());
     logger.log('note', '📦 Elasticsearch:');
 
     const config = this.config.getConfig();
@@ -1271,6 +1796,13 @@ export class ServiceManager {
    * Stop MongoDB service
    */
   public async stopMongoDB(): Promise<void> {
+    await withServiceDataOperationLock(process.cwd(), 'mongodb', () =>
+      this.stopMongoDBLocked(),
+    );
+  }
+
+  private async stopMongoDBLocked(): Promise<void> {
+    await this.config.reloadFromDisk();
     logger.log('note', '📦 MongoDB:');
     
     const containers = this.config.getContainerNames();
@@ -1287,30 +1819,57 @@ export class ServiceManager {
     }
   }
   
-  /**
-   * Stop MinIO service
-   */
-  public async stopMinIO(): Promise<void> {
-    logger.log('note', '📦 S3/MinIO:');
+  /** Stop only an exactly owned canonical ObjectStorage container. */
+  public async stopObjectStorage(): Promise<void> {
+    await withServiceDataOperationLock(process.cwd(), 'objectstorage', () =>
+      this.stopObjectStorageLocked(),
+    );
+  }
 
+  private async stopObjectStorageLocked(): Promise<void> {
+    await this.config.reloadFromDisk();
+    logger.log('note', '📦 S3/ObjectStorage:');
     const containers = this.config.getContainerNames();
-    const status = await this.docker.getStatus(containers.minio);
-
-    if (status === 'running') {
-      if (await this.docker.stop(containers.minio)) {
-        logger.log('ok', '  Stopped ✓');
-      } else {
-        logger.log('error', '  Failed to stop');
-      }
-    } else {
+    const directories = this.config.getDataDirectories();
+    const labels = getServiceContainerLabels({
+      projectPath: process.cwd(),
+      service: 'objectstorage',
+      dataPath: directories.objectstorage,
+    });
+    const timeout = () => ({ timeoutMs: 60_000 });
+    const id = await this.discoverContainerIdByExactName(
+      containers.objectstorage,
+      timeout,
+    );
+    if (!id) {
       logger.log('note', '  Not running');
+      return;
     }
+    const inspection = await this.revalidateObjectStorageContainer(
+      id,
+      containers.objectstorage,
+      labels,
+      timeout,
+    );
+    if (!inspection.running) {
+      logger.log('note', '  Not running');
+      return;
+    }
+    await this.docker.execArgv(['stop', inspection.id], timeout());
+    logger.log('ok', '  Stopped ✓');
   }
 
   /**
    * Stop Elasticsearch service
    */
   public async stopElasticsearch(): Promise<void> {
+    await withServiceDataOperationLock(process.cwd(), 'elasticsearch', () =>
+      this.stopElasticsearchLocked(),
+    );
+  }
+
+  private async stopElasticsearchLocked(): Promise<void> {
+    await this.config.reloadFromDisk();
     logger.log('note', '📦 Elasticsearch:');
 
     const containers = this.config.getContainerNames();
@@ -1372,13 +1931,52 @@ export class ServiceManager {
     mongo.authEnabled = this.config.isMongoAuthEnabled();
     mongo.authSource = this.config.getMongoAuthSource();
 
-    const minio = await describe(
-      'minio',
-      containers.minio,
-      directories.minio,
-      config.S3_PORT,
-      `http://${config.S3_HOST}:${config.S3_PORT}`,
+    const objectStorageDataExists = await plugins.smartfs.directory(
+      directories.objectstorage,
+    ).exists();
+    const objectStorageLabels = getServiceContainerLabels({
+      projectPath: process.cwd(),
+      service: 'objectstorage',
+      dataPath: directories.objectstorage,
+    });
+    const objectStorageId = await this.discoverContainerIdByExactName(
+      containers.objectstorage,
+      () => ({ timeoutMs: 60_000 }),
     );
+    let objectStorageStatus: ContainerStatus = 'not_exists';
+    let objectStorageOwnership: IServiceStatus['ownership'] = 'absent';
+    if (objectStorageId) {
+      const inspection = await this.inspectObjectStorageIdentity(
+        objectStorageId,
+        containers.objectstorage,
+        () => ({ timeoutMs: 60_000 }),
+      );
+      objectStorageStatus = inspection.running ? 'running' : 'stopped';
+      objectStorageOwnership = hasExactServiceContainerLabels(
+        inspection.labels,
+        objectStorageLabels,
+      )
+        ? 'owned'
+        : 'conflict';
+    }
+    const objectstorage: IServiceStatus = {
+      service: 'objectstorage',
+      enabled: this.isServiceEnabled('objectstorage'),
+      container: containers.objectstorage,
+      status: objectStorageStatus,
+      port: config.S3_PORT,
+      connectionString: `http://127.0.0.1:${config.S3_PORT}`,
+      managementUi: `http://127.0.0.1:${config.S3_UI_PORT}`,
+      dataDirectory: directories.objectstorage,
+      dataSizeBytes: objectStorageDataExists
+        ? await helpers.getDirectorySize(directories.objectstorage)
+        : 0,
+      portAvailable:
+        objectStorageStatus === 'not_exists'
+          ? await helpers.isPortAvailable(parseInt(config.S3_PORT))
+          : null,
+      ownership: objectStorageOwnership,
+    };
     const elasticsearch = await describe(
       'elasticsearch',
       containers.elasticsearch,
@@ -1387,14 +1985,35 @@ export class ServiceManager {
       config.ELASTICSEARCH_URL,
     );
 
+    const projectPath = plugins.path.resolve(process.cwd());
+    const registryProjects = await this.globalRegistry.getAllProjects();
+    const registryProject = Object.entries(registryProjects).find(
+      ([registeredPath]) => plugins.path.resolve(registeredPath) === projectPath,
+    )?.[1];
+    const legacyDataDirectory = getLegacyMinioDataDirectory(projectPath);
+    const legacyContainerExists = await this.discoverContainerIdByExactName(
+      containers.legacyMinio,
+      () => ({ timeoutMs: 60_000 }),
+    );
+
     return {
       project: {
         name: config.PROJECT_NAME,
         path: process.cwd(),
         enabledServices: this.enabledServices || [],
       },
-      services: { mongodb: mongo, minio, elasticsearch },
-      totalDataBytes: mongo.dataSizeBytes + minio.dataSizeBytes + elasticsearch.dataSizeBytes,
+      services: { mongodb: mongo, objectstorage, elasticsearch },
+      legacy: {
+        ...(registryProject?.legacy?.minioContainer
+          ? { minioContainer: registryProject.legacy.minioContainer }
+          : legacyContainerExists
+            ? { minioContainer: containers.legacyMinio }
+            : {}),
+        minioDataDirectory: legacyDataDirectory,
+        minioDataExists: await plugins.smartfs.directory(legacyDataDirectory).exists(),
+      },
+      totalDataBytes:
+        mongo.dataSizeBytes + objectstorage.dataSizeBytes + elasticsearch.dataSizeBytes,
     };
   }
 
@@ -1406,6 +2025,7 @@ export class ServiceManager {
 
     const config = this.config.getConfig();
     const containers = this.config.getContainerNames();
+    const structuredStatus = await this.collectStatus();
 
     logger.log('info', `Project: ${config.PROJECT_NAME}`);
     console.log();
@@ -1448,47 +2068,61 @@ export class ServiceManager {
         break;
     }
     
-    // MinIO status
-    const minioStatus = await this.docker.getStatus(containers.minio);
-    switch (minioStatus) {
+    // ObjectStorage status
+    const objectstorage = structuredStatus.services.objectstorage;
+    if (objectstorage.ownership === 'conflict') {
+      logger.log(
+        'error',
+        `📦 S3/ObjectStorage: ownership conflict for ${objectstorage.container}; refusing to treat it as managed`,
+      );
+    } else switch (objectstorage.status) {
       case 'running':
-        logger.log('ok', '📦 S3/MinIO: 🟢 Running');
-        logger.log('info', `   ├─ Container: ${containers.minio}`);
-        logger.log('info', `   ├─ API: http://${config.S3_HOST}:${config.S3_PORT}`);
-        logger.log('info', `   ├─ Console: http://${config.S3_HOST}:${config.S3_CONSOLE_PORT}`);
+        logger.log('ok', '📦 S3/ObjectStorage: 🟢 Running');
+        logger.log('info', `   ├─ Container: ${containers.objectstorage}`);
+        logger.log('info', `   ├─ API: http://127.0.0.1:${config.S3_PORT}`);
+        logger.log('info', `   ├─ Management UI: http://127.0.0.1:${config.S3_UI_PORT}`);
         logger.log('info', `   └─ Bucket: ${config.S3_BUCKET}`);
         break;
       case 'stopped':
-        logger.log('note', '📦 S3/MinIO: 🟡 Stopped');
-        logger.log('info', `   ├─ Container: ${containers.minio}`);
+        logger.log('note', '📦 S3/ObjectStorage: 🟡 Stopped');
+        logger.log('info', `   ├─ Container: ${containers.objectstorage}`);
         logger.log('info', `   ├─ API Port: ${config.S3_PORT}`);
-        logger.log('info', `   └─ Console Port: ${config.S3_CONSOLE_PORT}`);
+        logger.log('info', `   └─ Management UI Port: ${config.S3_UI_PORT}`);
         break;
       case 'not_exists':
-        logger.log('info', '📦 S3/MinIO: ⚪ Not installed');
+        logger.log('info', '📦 S3/ObjectStorage: ⚪ Not installed');
         // Check port availability
         const s3Port = parseInt(config.S3_PORT);
-        const s3ConsolePort = parseInt(config.S3_CONSOLE_PORT);
+        const s3UiPort = parseInt(config.S3_UI_PORT);
         const s3Available = await helpers.isPortAvailable(s3Port);
-        const consoleAvailable = await helpers.isPortAvailable(s3ConsolePort);
+        const uiAvailable = await helpers.isPortAvailable(s3UiPort);
         
-        if (!s3Available || !consoleAvailable) {
+        if (!s3Available || !uiAvailable) {
           if (!s3Available) {
             logger.log('error', `   ├─ ⚠️  API Port ${s3Port} is in use`);
           } else {
             logger.log('info', `   ├─ API Port ${s3Port} is available`);
           }
-          if (!consoleAvailable) {
-            logger.log('error', `   └─ ⚠️  Console Port ${s3ConsolePort} is in use`);
+          if (!uiAvailable) {
+            logger.log('error', `   └─ ⚠️  Management UI Port ${s3UiPort} is in use`);
           } else {
-            logger.log('info', `   └─ Console Port ${s3ConsolePort} is available`);
+            logger.log('info', `   └─ Management UI Port ${s3UiPort} is available`);
           }
         } else {
           logger.log('info', `   ├─ API Port ${s3Port} is available`);
-          logger.log('info', `   └─ Console Port ${s3ConsolePort} is available`);
+          logger.log('info', `   └─ Management UI Port ${s3UiPort} is available`);
         }
         break;
     }
+    if (
+      structuredStatus.legacy.minioContainer ||
+      structuredStatus.legacy.minioDataExists
+    ) {
+      logger.log(
+        'note',
+        '   Legacy MinIO resources are preserved and block automatic ObjectStorage startup; run `gitzone services start s3` for exact migration instructions.',
+      );
+    }
 
     // Elasticsearch status
     const esStatus = await this.docker.getStatus(containers.elasticsearch);
@@ -1531,7 +2165,7 @@ export class ServiceManager {
     const directories = this.config.getDataDirectories();
     const entries: Array<{ label: string; path: string }> = [
       { label: 'MongoDB', path: directories.mongo },
-      { label: 'S3/MinIO', path: directories.minio },
+      { label: 'S3/ObjectStorage', path: directories.objectstorage },
       { label: 'Elasticsearch', path: directories.elasticsearch },
     ];
 
@@ -1546,11 +2180,22 @@ export class ServiceManager {
       total += size;
       logger.log('info', `  ${entry.label}: ${helpers.formatBytes(size)}  (${entry.path})`);
     }
+    const legacyDataPath = getLegacyMinioDataDirectory(process.cwd());
+    const legacyDataExists = await plugins.smartfs.directory(legacyDataPath).exists();
     if (total === 0) {
-      logger.log('info', '  No service data directories present');
+      logger.log('info', '  No canonical service data directories present');
+    } else {
+      logger.log('info', `  Total: ${helpers.formatBytes(total)}`);
+    }
+    if (legacyDataExists) {
+      logger.log(
+        'note',
+        `  Legacy MinIO data is preserved and excluded from cleanup: ${legacyDataPath}`,
+      );
+    }
+    if (total === 0 && !legacyDataExists) {
       return;
     }
-    logger.log('info', `  Total: ${helpers.formatBytes(total)}`);
     logger.log(
       'note',
       '  Remove containers but keep data: `gitzone services remove`; remove data too: `gitzone services clean`',
@@ -1578,18 +2223,20 @@ export class ServiceManager {
     logger.log('info', `  Connection: ${this.config.getMongoConnectionString()}`);
     
     console.log();
-    logger.log('note', 'S3/MinIO:');
+    logger.log('note', 'S3/ObjectStorage:');
     logger.log('info', `  Host: ${config.S3_HOST}`);
     logger.log('info', `  API Port: ${config.S3_PORT}`);
-    logger.log('info', `  Console Port: ${config.S3_CONSOLE_PORT}`);
+    logger.log('info', `  Management UI Port: ${config.S3_UI_PORT}`);
     logger.log('info', '  Access Key: ***');
     logger.log('info', '  Secret Key: ***');
+    logger.log('info', '  Admin Password: ***');
     logger.log('info', `  Bucket: ${config.S3_BUCKET}`);
     logger.log('info', `  Use SSL: ${config.S3_USESSL}`);
-    logger.log('info', `  Container: ${this.config.getContainerNames().minio}`);
-    logger.log('info', `  Data: ${this.config.getDataDirectories().minio}`);
+    logger.log('info', `  Region: ${config.S3_REGION}`);
+    logger.log('info', `  Container: ${this.config.getContainerNames().objectstorage}`);
+    logger.log('info', `  Data: ${this.config.getDataDirectories().objectstorage}`);
     logger.log('info', `  Endpoint: ${config.S3_ENDPOINT}`);
-    logger.log('info', `  Console URL: http://${config.S3_HOST}:${config.S3_CONSOLE_PORT}`);
+    logger.log('info', `  Management UI: http://127.0.0.1:${config.S3_UI_PORT}`);
 
     console.log();
     logger.log('note', 'Elasticsearch:');
@@ -1646,14 +2293,48 @@ export class ServiceManager {
         }
         break;
         
-      case 'minio':
+      case 'objectstorage':
       case 's3':
-        if (await this.docker.isRunning(containers.minio)) {
-          helpers.printHeader(`S3/MinIO Logs (last ${lines} lines)`);
-          const logs = await this.docker.logs(containers.minio, lines);
-          console.log(logs);
-        } else {
-          logger.log('note', 'S3/MinIO container is not running');
+        {
+          const directories = this.config.getDataDirectories();
+          const labels = getServiceContainerLabels({
+            projectPath: process.cwd(),
+            service: 'objectstorage',
+            dataPath: directories.objectstorage,
+          });
+          const timeout = () => ({ timeoutMs: 60_000 });
+          const id = await this.discoverContainerIdByExactName(
+            containers.objectstorage,
+            timeout,
+          );
+          if (!id) {
+            logger.log('note', 'S3/ObjectStorage container does not exist');
+            break;
+          }
+          await this.revalidateObjectStorageContainer(
+            id,
+            containers.objectstorage,
+            labels,
+            timeout,
+          );
+          helpers.printHeader(`S3/ObjectStorage Logs (last ${lines} lines)`);
+          const result = await this.docker.execArgv(
+            ['logs', '--tail', String(lines), id],
+            timeout(),
+          );
+          const config = this.config.getConfig();
+          let output = `${result.stdout}${result.stderr}`;
+          const secrets = Array.from(
+            new Set([
+              config.S3_ACCESSKEY,
+              config.S3_SECRETKEY,
+              config.S3_ADMIN_PASSWORD,
+            ].filter(Boolean)),
+          ).sort((secretA, secretB) => secretB.length - secretA.length);
+          for (const secret of secrets) {
+            output = output.split(secret).join('***');
+          }
+          console.log(output);
         }
         break;
 
@@ -1672,7 +2353,7 @@ export class ServiceManager {
       case '':
         await this.showLogs('mongo', lines);
         console.log();
-        await this.showLogs('minio', lines);
+        await this.showLogs('objectstorage', lines);
         console.log();
         await this.showLogs('elasticsearch', lines);
         break;
@@ -1687,42 +2368,175 @@ export class ServiceManager {
    * Remove containers
    */
   public async removeContainers(): Promise<void> {
-    const containers = this.config.getContainerNames();
-    let removed = false;
+    await this.withProjectServiceLocks(process.cwd(), () => this.removeContainersLocked());
+  }
 
-    if (await this.docker.exists(containers.mongo)) {
-      if (await this.docker.remove(containers.mongo, true)) {
-        logger.log('ok', '  MongoDB container removed ✓');
-        removed = true;
+  private async removeContainersLocked(): Promise<void> {
+    await this.config.reloadFromDisk();
+    const containers = this.config.getContainerNames();
+    const directories = this.config.getDataDirectories();
+    const projectPath = plugins.path.resolve(process.cwd());
+    const registryProjects = await this.globalRegistry.getAllProjects();
+    const registryProject = Object.entries(registryProjects).find(
+      ([registeredPathArg]) => plugins.path.resolve(registeredPathArg) === projectPath,
+    )?.[1];
+    const targets = new Map<
+      string,
+      { service: TServiceName; name: string; registered: boolean }
+    >();
+    const addTarget = (
+      serviceArg: TServiceName,
+      nameArg: string | undefined,
+      registeredArg: boolean,
+    ): void => {
+      if (!nameArg) return;
+      const existing = targets.get(nameArg);
+      if (existing && existing.service !== serviceArg) {
+        throw new Error(`Refusing ambiguous service container name: ${nameArg}`);
       }
-    }
-
-    if (await this.docker.exists(containers.minio)) {
-      if (await this.docker.remove(containers.minio, true)) {
-        logger.log('ok', '  S3/MinIO container removed ✓');
-        removed = true;
+      targets.set(nameArg, {
+        service: serviceArg,
+        name: nameArg,
+        registered: registeredArg || existing?.registered === true,
+      });
+    };
+    addTarget('mongodb', containers.mongo, false);
+    addTarget('objectstorage', containers.objectstorage, false);
+    addTarget('elasticsearch', containers.elasticsearch, false);
+    addTarget('mongodb', registryProject?.containers.mongo, true);
+    addTarget('objectstorage', registryProject?.containers.objectstorage, true);
+    addTarget('elasticsearch', registryProject?.containers.elasticsearch, true);
+
+    const plannedRemovals: Array<{
+      service: TServiceName;
+      name: string;
+      inspection: IContainerInspectInfo;
+    }> = [];
+    for (const target of targets.values()) {
+      const id = await this.discoverContainerIdByExactName(
+        target.name,
+        () => ({ timeoutMs: 60_000 }),
+      );
+      if (!id) continue;
+      const inspections = await this.docker.inspectMany([id]);
+      const inspection = inspections[0];
+      if (!inspection || inspection.id !== id || inspection.name !== target.name) {
+        throw new Error(`Refusing ambiguous service container identity: ${target.name}`);
+      }
+      const expectedLabels = getServiceContainerLabels({
+        projectPath,
+        service: target.service,
+        dataPath:
+          target.service === 'mongodb'
+            ? directories.mongo
+            : target.service === 'objectstorage'
+              ? directories.objectstorage
+              : directories.elasticsearch,
+      });
+      const labelOwned = hasExactServiceContainerLabels(inspection.labels, expectedLabels);
+      const hasGitZoneLabels = Object.keys(inspection.labels).some((keyArg) =>
+        keyArg.startsWith('git.zone.'),
+      );
+      const registryClaims = Object.entries(registryProjects).flatMap(
+        ([registeredPathArg, projectArg]) => {
+          const claims: Array<{ projectPath: string; service: TServiceName }> = [];
+          if (projectArg.containers.mongo === target.name) {
+            claims.push({ projectPath: plugins.path.resolve(registeredPathArg), service: 'mongodb' });
+          }
+          if (projectArg.containers.objectstorage === target.name) {
+            claims.push({
+              projectPath: plugins.path.resolve(registeredPathArg),
+              service: 'objectstorage',
+            });
+          }
+          if (projectArg.containers.elasticsearch === target.name) {
+            claims.push({
+              projectPath: plugins.path.resolve(registeredPathArg),
+              service: 'elasticsearch',
+            });
+          }
+          return claims;
+        },
+      );
+      const registryOwned =
+        !hasGitZoneLabels &&
+        target.registered &&
+        target.service !== 'objectstorage' &&
+        registryClaims.length === 1 &&
+        registryClaims[0].projectPath === projectPath &&
+        registryClaims[0].service === target.service;
+      if (!labelOwned && !registryOwned) {
+        throw new Error(`Refusing to remove container with unproven ownership: ${target.name}`);
       }
+      plannedRemovals.push({ service: target.service, name: target.name, inspection });
     }
 
-    if (await this.docker.exists(containers.elasticsearch)) {
-      if (await this.docker.remove(containers.elasticsearch, true)) {
-        logger.log('ok', '  Elasticsearch container removed ✓');
-        removed = true;
-      }
+    if (
+      plannedRemovals.some((removalArg) => removalArg.service === 'objectstorage') &&
+      (await plugins.smartfs.directory(directories.objectstorage).exists())
+    ) {
+      await this.repairObjectStorageMarkerFromOwnedContainer(directories.objectstorage);
+    }
+    for (const removal of plannedRemovals) {
+      await this.docker.execArgv(['rm', '-f', removal.inspection.id], { timeoutMs: 60_000 });
+      const label =
+        removal.service === 'mongodb'
+          ? 'MongoDB'
+          : removal.service === 'objectstorage'
+            ? 'S3/ObjectStorage'
+            : 'Elasticsearch';
+      logger.log('ok', `  ${label} container removed ✓`);
     }
 
-    if (!removed) {
+    if (plannedRemovals.length === 0) {
       logger.log('note', '  No containers to remove');
     }
 
-    // Check if all containers are gone, then unregister from global registry
-    const mongoExists = await this.docker.exists(containers.mongo);
-    const minioExists = await this.docker.exists(containers.minio);
-    const esExists = await this.docker.exists(containers.elasticsearch);
+    // Re-read and prove every current claim absent while all service locks are
+    // still held. A concurrent internal start cannot appear between this check
+    // and the compare-delete registry transaction.
+    const currentProjects = await this.globalRegistry.getAllProjects();
+    const currentProject = Object.entries(currentProjects).find(
+      ([registeredPathArg]) => plugins.path.resolve(registeredPathArg) === projectPath,
+    )?.[1];
+    const legacyDataExists = await plugins.smartfs.directory(
+      getLegacyMinioDataDirectory(projectPath),
+    ).exists();
+    if (currentProject && !currentProject.legacy?.minioContainer && !legacyDataExists) {
+      const labeledIds = await this.docker.listIds([
+        `label=git.zone.project-path=${projectPath}`,
+      ]);
+      let registeredContainerExists = labeledIds.length > 0;
+      for (const containerName of Object.values(currentProject.containers)) {
+        if (!containerName) continue;
+        if (
+          await this.discoverContainerIdByExactName(
+            containerName,
+            () => ({ timeoutMs: 60_000 }),
+          )
+        ) {
+          registeredContainerExists = true;
+          break;
+        }
+      }
+      if (!registeredContainerExists) {
+        await this.globalRegistry.unregisterProject(process.cwd(), currentProject);
+      }
+    }
+  }
 
-    if (!mongoExists && !minioExists && !esExists) {
-      await this.globalRegistry.unregisterProject(process.cwd());
+  private async withProjectServiceLocks<T>(
+    projectPathArg: string,
+    actionArg: () => Promise<T>,
+    serviceIndexArg = 0,
+  ): Promise<T> {
+    const service = serviceNames[serviceIndexArg];
+    if (!service) {
+      return actionArg();
     }
+    return withServiceDataOperationLock(projectPathArg, service, () =>
+      this.withProjectServiceLocks(projectPathArg, actionArg, serviceIndexArg + 1),
+    );
   }
   
   /**
@@ -1732,18 +2546,23 @@ export class ServiceManager {
     const directories = this.config.getDataDirectories();
     const targets: Array<{ label: string; service: TServiceName; path: string }> = [
       { label: 'MongoDB', service: 'mongodb', path: directories.mongo },
-      { label: 'S3/MinIO', service: 'minio', path: directories.minio },
+      { label: 'S3/ObjectStorage', service: 'objectstorage', path: directories.objectstorage },
       { label: 'Elasticsearch', service: 'elasticsearch', path: directories.elasticsearch },
     ];
 
     let cleaned = false;
     for (const target of targets) {
-      if (!(await plugins.smartfs.directory(target.path).exists())) {
+      const removed = await this.docker.removeDataDirectory(
+        target.path,
+        serviceImages[target.service],
+        {
+        projectPath: process.cwd(),
+        service: target.service,
+        },
+      );
+      if (!removed) {
         continue;
       }
-      // Escalates to a privileged one-off container when needed; throws rather
-      // than leaving a partially deleted (and for MongoDB, corrupt) directory.
-      await this.docker.removeDataDirectory(target.path, serviceImages[target.service]);
       logger.log('ok', `  ${target.label} data removed ✓`);
       cleaned = true;
     }
@@ -1751,6 +2570,13 @@ export class ServiceManager {
     if (!cleaned) {
       logger.log('note', '  No data to clean');
     }
+    const legacyDataPath = getLegacyMinioDataDirectory(process.cwd());
+    if (await plugins.smartfs.directory(legacyDataPath).exists()) {
+      logger.log(
+        'note',
+        `  Legacy MinIO data was preserved and not modified: ${legacyDataPath}`,
+      );
+    }
   }
   
   /**
@@ -1760,7 +2586,7 @@ export class ServiceManager {
     logger.log('note', 'Select which services to enable for this project:');
     console.log();
 
-    const currentServices = this.enabledServices || ['mongodb', 'minio', 'elasticsearch'];
+    const currentServices = this.enabledServices || ['mongodb', 'objectstorage', 'elasticsearch'];
 
     const smartinteract = new plugins.smartinteract.SmartInteract();
     const response = await smartinteract.askQuestion({
@@ -1769,13 +2595,13 @@ export class ServiceManager {
       message: 'Which services do you want to enable?',
       choices: [
         { name: 'MongoDB', value: 'mongodb' },
-        { name: 'MinIO (S3)', value: 'minio' },
+        { name: 'ObjectStorage (S3)', value: 'objectstorage' },
         { name: 'Elasticsearch', value: 'elasticsearch' }
       ],
       default: currentServices
     });
 
-    const enabledServices = response.value || ['mongodb', 'minio', 'elasticsearch'];
+    const enabledServices = response.value || ['mongodb', 'objectstorage', 'elasticsearch'];
     this.enabledServices = enabledServices;
 
     // Save to .smartconfig.json
@@ -1789,31 +2615,10 @@ export class ServiceManager {
    */
   public async reconfigure(): Promise<void> {
     helpers.printHeader('Reconfiguring Services');
-    
-    const containers = this.config.getContainerNames();
-    
-    // Stop existing containers
-    logger.log('note', '🛑 Stopping existing containers...');
+    await this.withProjectServiceLocks(process.cwd(), () => this.reconfigureLocked());
 
-    if (await this.docker.exists(containers.mongo)) {
-      await this.docker.stop(containers.mongo);
-      logger.log('ok', '  MongoDB stopped ✓');
-    }
-
-    if (await this.docker.exists(containers.minio)) {
-      await this.docker.stop(containers.minio);
-      logger.log('ok', '  S3/MinIO stopped ✓');
-    }
-
-    if (await this.docker.exists(containers.elasticsearch)) {
-      await this.docker.stop(containers.elasticsearch);
-      logger.log('ok', '  Elasticsearch stopped ✓');
-    }
-
-    // Reconfigure ports
-    await this.config.reconfigurePorts();
-
-    // Ask if user wants to restart services
+    // Ask if user wants to restart services after releasing the reconfiguration
+    // locks; startAll acquires the same locks one service at a time.
     const smartinteract = new plugins.smartinteract.SmartInteract();
     const response = await smartinteract.askQuestion({
       name: 'restart',
@@ -1825,6 +2630,21 @@ export class ServiceManager {
     if (response.value) {
       console.log();
       await this.startAll();
+      await this.registerWithGlobalRegistry();
     }
   }
+
+  private async reconfigureLocked(): Promise<void> {
+    await this.config.reloadFromDisk();
+    await this.assertNoLegacyMinioResources(() => ({ timeoutMs: 60_000 }));
+
+    // Stop existing containers
+    logger.log('note', '🛑 Stopping existing containers...');
+    await this.stopMongoDBLocked();
+    await this.stopObjectStorageLocked();
+    await this.stopElasticsearchLocked();
+
+    // Reconfigure ports
+    await this.config.reconfigurePorts();
+  }
 }