docs(keycloak-session-store): import the session-storage lab as a new project

The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.

Follows the import procedure in README.md.

  source/     the originating repository verbatim — 78 documents, 28 SVGs,
              8 manifests, plus .source-revision recording the commit
  final/      the SSOT
    document.md   729 lines written from the 29 experiment documents, not
                  concatenated: what was predicted, what was measured, and
                  where the measurement itself was wrong
    evidence/raw    125 outputs, flattened to <experiment>__<file> because
                    the originals collided (01-baseline.txt appeared three
                    times) and the audit only globs the top level
    evidence/meta   one per raw file; command and exitCode are null and the
                    README says why rather than inventing them
    evidence/browser  22 captures
    assets/       three diagrams through techviz
    .techviz/     their VizSpecs

A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.

Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.

verify-pipeline.py passes. audit-records.py reports no issues.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/clean-architecture-backend-template/final/evidence/raw/153-objectstorage-s3-probes.txt

@@ -0,0 +1,332 @@
+Sub-scope 04 (objectstorage) s3/** - provider binding, client policy, async bridges, providers
+revision=a24ece9cf797f7ea647e33bf846b115208ed1ba5
+generatedAt=2026-08-30T02:46:24+00:00
+
+=== OWNED FILES ===
+c736a00af636ce33932ac81fdb639a9f8571f36b s3/S3AsyncClientFactory.java 69
+019d11138e010247723336164a6bb675d39946ed s3/S3AsyncRequestBodyBridge.java 270
+eb4a06038a10ef7ad968a9c65dc3a2933b1b71a7 s3/S3AsyncResponseBodyBridge.java 342
+8921803dceeba2839db95f1a46a38875938cac1b s3/S3CapabilityProbe.java 42
+f1b13054e3a2457d94cb84d9ae4cf6d444d75683 s3/S3ChecksumPolicy.java 43
+84396fadf519bb404fc368b8270705b12e8d4ad4 s3/S3ClientLifecycle.java 59
+329d53f84103c542c1e1f534e7abce2b2e997f10 s3/S3ClientPolicy.java 367
+f7a57a87928e2bec0491664cbf10ae97befce4fe s3/S3ConditionalObjectControlStore.java 279
+a4180450809282b4e95a8fccc104e13d3c203e5c s3/S3ConditionalRequestMapper.java 65
+5d8d35240d5a4a43b607a55fcdbfc27a532a61e8 s3/S3DirectCompletionVerifier.java 74
+9db6d172c12fc5cc7fe4468e2888d697c55a1cbd s3/S3DirectMultipartProvider.java 324
+acad97412bf662866837f3c651fcf093b0d13cf6 s3/S3DirectTransferProvider.java 144
+acd82d10d52a8973daf3d6b913c155fa94f64972 s3/S3ManagedMultipartProvider.java 281
+dc987d674d1a33a28448d231b54dd3f913bcba89 s3/S3ManagedObjectProvider.java 213
+669b7a0781a112505cbc05e3bc49e2d8ea334066 s3/S3ObjectEvidenceMapper.java 82
+4772bcd70265b1292bf81506a9495d0c910b2e48 s3/S3ObjectOperationResolver.java 53
+09eccbeefeb9fa283eb63eafdafbe9b7284217a5 s3/S3ObjectStorageProviderContribution.java 190
+f999696a46d9f76b0ea7e3fa730ea179ddae8021 s3/S3PresignerFactory.java 24
+482bf89618e84d0fe6e7d64a25bab82efe582426 s3/S3ProviderBinding.java 361
+d68446f26ddb6d5e6d8e98061c77c4deb589142c s3/S3ProviderCapabilityConfig.java 41
+54964c9b1f4f8453e09b77eb7dae7d4c31cd59e9 s3/S3ProviderErrorMapper.java 78
+b2ee18c3ee94c4a85cb0a681e21a1a445fd151a2 s3/S3ProviderQualifier.java 58
+00de3d38a968368c363142f23c3e9895671396c3 s3/S3ProviderSettings.java 52
+6ee78a77458349929666c8a744fcc3850d993d5b s3/S3ProviderType.java 26
+6c75433066baaa0b14c4872536ee0de3847bb6cd s3/S3ProviderVersion.java 29
+6fdba8a52a6f2ef514fa4468fc24eae203a86962 s3/S3QualificationEvidence.java 15
+2acf00be0158ab5c1c468f2f0b71a9e8a74fc402 test/s3/S3AsyncClientFactoryTest.java 179
+d389c9af956cd6711556f0851c751dfaf2013c77 test/s3/S3AsyncRequestBodyBridgeTest.java 165
+ae891add40c16119793e61bdc6ea8bcb85a38c77 test/s3/S3AsyncResponseBodyBridgeTest.java 133
+68fa30eb3d9796f69b5b61c06b008fce59adfe5e test/s3/S3ConditionalObjectControlStoreTest.java 172
+d60074a7f815098d2a7e59cb4f31bd1e9680c158 test/s3/S3DirectMultipartProviderTest.java 72
+d4c3d86158b3f46aedff8bcd31c6fabe180426e3 test/s3/S3DirectTransferProviderTest.java 123
+71bd20f2f9c33ff8e8f2f0f06577bae3a532829c test/s3/S3ManagedMultipartProviderTest.java 134
+b18c3224b13b701167cd047b28f1936f17280c69 test/s3/S3ManagedObjectProviderTest.java 255
+405c3e935cf997d8b08746be3922656a18d457ae test/s3/S3ObjectOperationResolverTest.java 151
+23fd021ff93fa5ee59637aa35add37685ed89872 test/s3/S3ProviderBindingTest.java 468
+fa7c910a87c64dec61d3cc8762718ab882ea9e7c test/s3/S3ProviderCompositionTest.java 197
+f63aa1c373c887fef82fbfcad86788ac64e6be46 test/s3/S3ProviderErrorMapperTest.java 63
+a9796529253b2d9b159a17606af1256d42c171b3 test/s3/S3ProviderQualifierTest.java 96
+9fc3ebe5e8b0ba05937577c2d59e71ca82e88834 test/s3/S3SdkApiCharacterizationTest.java 115
+main LOC:   3581 total
+
+=== 8.1 reachability: SDK types confined to this package? ===
+$ git grep -rln 'software.amazon.awssdk' -- 'adapter/outbound/objectstorage/src/main' | sed 's|.*/objectstorage/||' | sort | uniq -c
+      1 ObjectStorageConfig.java
+      1 S3ObjectStorageAdapter.java
+      1 config/ObjectStorageCapabilityConfig.java
+      1 s3/S3AsyncClientFactory.java
+      1 s3/S3AsyncRequestBodyBridge.java
+      1 s3/S3AsyncResponseBodyBridge.java
+      1 s3/S3ChecksumPolicy.java
+      1 s3/S3ClientLifecycle.java
+      1 s3/S3ClientPolicy.java
+      1 s3/S3ConditionalObjectControlStore.java
+      1 s3/S3ConditionalRequestMapper.java
+      1 s3/S3DirectCompletionVerifier.java
+      1 s3/S3DirectMultipartProvider.java
+      1 s3/S3DirectTransferProvider.java
+      1 s3/S3ManagedMultipartProvider.java
+      1 s3/S3ManagedObjectProvider.java
+      1 s3/S3ObjectEvidenceMapper.java
+      1 s3/S3ObjectStorageProviderContribution.java
+      1 s3/S3PresignerFactory.java
+      1 s3/S3ProviderErrorMapper.java
+exit=0
+
+$ git grep -rln 'software.amazon.awssdk' -- . | grep -v "^adapter/outbound/objectstorage/" | head
+adapter/inbound/graphql/src/main/java/dev/caskeleton/adapter/inbound/graphql/architecture/GraphQlReturnTypePolicy.java
+adapter/inbound/web/src/testkit/java/dev/caskeleton/adapter/inbound/web/testkit/arch/WebForbiddenTypeCatalog.java
+app-bootstrap/build.gradle
+app-bootstrap/gradle.lockfile
+app-bootstrap/src/test/java/dev/caskeleton/bootstrap/architecture/NotificationArchitectureTest.java
+application-core/src/test/java/dev/caskeleton/application/objectstorage/ObjectStorageArchitectureContractTest.java
+build.gradle
+sample-portfolio/build.gradle
+sample-portfolio/gradle.lockfile
+exit=0
+
+=== 8.2 client policy: the retry budget is checked against the parent call budget ===
+$ grep -n 'retryWorstCase' -B 4 -A 6 adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ClientPolicy.java
+151-    }
+152-    if (source.retryBaseDelay.compareTo(source.retryMaximumBackoff) > 0) {
+153-      throw invalid("retry base delay exceeds maximum backoff");
+154-    }
+155:    Duration retryWorstCase =
+156-        multiply(source.apiCallAttemptTimeout, source.maximumAttempts)
+157-            .plus(multiply(source.retryMaximumBackoff, source.maximumAttempts - 1L));
+158:    if (retryWorstCase.compareTo(source.apiCallTimeout) > 0) {
+159-      throw invalid("retry attempts and backoff exceed the parent call budget");
+160-    }
+161-    validateEndpoint(source.endpointOverride);
+162-    boolean accessPresent = source.accessKeyId != null && !source.accessKeyId.isBlank();
+163-    boolean secretPresent = source.secretAccessKey != null && !source.secretAccessKey.isBlank();
+164-    if (accessPresent != secretPresent) {
+exit=0
+
+$ grep -n 'transport timeout exceeds the per-attempt timeout\|per-attempt timeout must be shorter' -B 4 adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ClientPolicy.java
+130-    requirePositive("retryBaseDelay", source.retryBaseDelay);
+131-    requirePositive("retryMaximumBackoff", source.retryMaximumBackoff);
+132-    requirePositive("shutdownGrace", source.shutdownGrace);
+133-    if (source.apiCallAttemptTimeout.compareTo(source.apiCallTimeout) >= 0) {
+134:      throw invalid("per-attempt timeout must be shorter than the parent call timeout");
+--
+140-            source.connectionAcquireTimeout,
+141-            source.readTimeout,
+142-            source.writeTimeout)) {
+143-      if (transport.compareTo(source.apiCallAttemptTimeout) > 0) {
+144:        throw invalid("transport timeout exceeds the per-attempt timeout");
+exit=0
+
+$ grep -n 'plaintext AWS endpoint is forbidden' -B 6 adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ClientPolicy.java
+190-        || endpoint.getQuery() != null
+191-        || endpoint.getFragment() != null) {
+192-      throw invalid("endpoint override is not canonical");
+193-    }
+194-    if ("http".equalsIgnoreCase(scheme)
+195-        && (host.equals("amazonaws.com") || host.endsWith(".amazonaws.com"))) {
+196:      throw invalid("plaintext AWS endpoint is forbidden");
+exit=0
+
+$ grep -n 'credentials=' -A 2 adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ClientPolicy.java
+225:        + ", credentials="
+226-        + (source.accessKeyId == null ? "default-chain" : "[REDACTED]")
+227-        + "]";
+exit=0
+
+=== 8.2b provider binding: per-provider-type identity rules ===
+$ grep -n 'AWS expected owner must be an exact 12-digit\|MinIO binding cannot claim\|AWS endpoint override is not part\|MinIO endpoint is required\|MinIO requires explicit environment credential' -B 3 adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ProviderBinding.java
+229-    requireToken("deploymentIdentity", settings.deploymentIdentity(), 256);
+230-    if (type == S3ProviderType.AWS_S3_GENERAL_PURPOSE) {
+231-      if (settings.expectedOwner() == null || !settings.expectedOwner().matches("[0-9]{12}")) {
+232:        throw invalid("AWS expected owner must be an exact 12-digit account ID");
+233-      }
+234-    } else if (settings.expectedOwner() != null && !settings.expectedOwner().isBlank()) {
+235:      throw invalid("MinIO binding cannot claim an AWS expected owner");
+--
+238-
+239-  private static void validateEndpoint(S3ProviderType type, URI endpoint) {
+240-    if (type == S3ProviderType.AWS_S3_GENERAL_PURPOSE && endpoint != null) {
+241:      throw invalid("AWS endpoint override is not part of the qualified profile");
+242-    }
+243-    if (type == S3ProviderType.MINIO_COMMUNITY_2024_01_16 && endpoint == null) {
+244:      throw invalid("MinIO endpoint is required");
+--
+279-        throw invalid("default-chain credentials cannot include static references");
+280-      }
+281-      if (type != S3ProviderType.AWS_S3_GENERAL_PURPOSE) {
+282:        throw invalid("MinIO requires explicit environment credential references");
+exit=0
+
+$ grep -n 'runtime provisioning and public ACLs are forbidden' -B 4 adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ProviderBinding.java
+265-  }
+266-
+267-  private static void validateProvisioning(S3ProviderSettings settings) {
+268-    if (settings.autoCreateBucket() || settings.publicAcl()) {
+269:      throw invalid("runtime provisioning and public ACLs are forbidden");
+exit=0
+
+=== 8.2c mutation uncertainty is preserved ===
+$ grep -n 'if (mutation)' -B 4 -A 4 adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ProviderErrorMapper.java
+17-    Objects.requireNonNull(failure, "failure must be non-null");
+18-    if (failure instanceof AwsServiceException service) {
+19-      return mapService(service, mutation);
+20-    }
+21:    if (mutation) {
+22-      return new Mapping(Failure.INDETERMINATE, false, "S3 mutation outcome is indeterminate");
+23-    }
+24-    Throwable cause = failure.getCause();
+25-    if (cause instanceof SocketTimeoutException
+exit=0
+
+$ grep -n 'authoritative' -B 2 -A 2 adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ProviderErrorMapper.java | head -20
+52-          default -> mapStatus(status, mutation);
+53-        };
+54:    boolean authoritative = normalized != Failure.INDETERMINATE;
+55:    return new Mapping(normalized, authoritative, "S3 request failed: " + normalized.name());
+56-  }
+57-
+--
+68-  }
+69-
+70:  /** Provider-neutral classification plus whether the observation is authoritative. */
+71:  public record Mapping(Failure failure, boolean authoritative, String safeMessage) {
+72-
+73-    public Mapping {
+exit=0
+
+$ grep -n 'Failure.INDETERMINATE' adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/*.java
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ConditionalObjectControlStore.java:114:      if (exception.failure() == ObjectStorageProviderException.Failure.INDETERMINATE) {
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ConditionalObjectControlStore.java:131:        ObjectStorageProviderException.Failure.INDETERMINATE,
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3DirectMultipartProvider.java:142:          ObjectStorageProviderException.Failure.INDETERMINATE,
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ManagedMultipartProvider.java:121:          ObjectStorageProviderException.Failure.INDETERMINATE,
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ProviderErrorMapper.java:22:      return new Mapping(Failure.INDETERMINATE, false, "S3 mutation outcome is indeterminate");
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ProviderErrorMapper.java:54:    boolean authoritative = normalized != Failure.INDETERMINATE;
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ProviderErrorMapper.java:66:      default -> mutation ? Failure.INDETERMINATE : Failure.UNKNOWN;
+exit=0
+
+=== 8.3 evidence: logical digest kept distinct from provider checksum ===
+$ grep -n 'LOGICAL_SHA_256_METADATA\|requireMatchingEvidence' -A 10 adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ChecksumPolicy.java | head -26
+12:  public static final String LOGICAL_SHA_256_METADATA = "ca-logical-sha256";
+13-
+14-  private S3ChecksumPolicy() {}
+15-
+16-  public static ChecksumAlgorithm requireSha256(ObjectContentIdentity identity) {
+17-    Objects.requireNonNull(identity, "identity must be non-null");
+18-    if (identity.fullDigest().algorithm() != ObjectDigestAlgorithm.SHA_256) {
+19-      throw new IllegalArgumentException("managed S3 profile requires logical SHA-256");
+20-    }
+21-    return ChecksumAlgorithm.SHA256;
+22-  }
+--
+26:    return Map.of(LOGICAL_SHA_256_METADATA, identity.fullDigest().base64Value());
+27-  }
+28-
+29:  public static void requireMatchingEvidence(
+30-      ObjectContentIdentity expected, String providerChecksum, Map<String, String> metadata) {
+31-    requireSha256(expected);
+32:    String logical = metadata == null ? null : metadata.get(LOGICAL_SHA_256_METADATA);
+33-    if (!expected.fullDigest().base64Value().equals(logical)
+34-        || (providerChecksum != null
+35-            && !expected.fullDigest().base64Value().equals(providerChecksum))) {
+36-      throw new dev.caskeleton.adapter.outbound.objectstorage.provider
+37-          .ObjectStorageProviderException(
+38-          dev.caskeleton.adapter.outbound.objectstorage.provider.ObjectStorageProviderException
+39-              .Failure.CONTENT_MISMATCH,
+exit=0
+
+$ grep -n 'ServerSideEncryption.AES256\|ETag evidence is absent' -B 3 adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ObjectEvidenceMapper.java
+41-    }
+42-    S3ChecksumPolicy.requireMatchingEvidence(
+43-        identity, response.checksumSHA256(), response.metadata());
+44:    if (response.serverSideEncryption() != ServerSideEncryption.AES256) {
+45-      throw corrupt("S3 HEAD encryption evidence does not match the managed profile");
+46-    }
+47-    if (response.eTag() == null || response.eTag().isBlank()) {
+48:      throw corrupt("S3 HEAD ETag evidence is absent");
+exit=0
+
+=== 8.3b async bridges: single subscription, bounded buffer, backpressure ===
+$ grep -n 'subscribed.compareAndSet(false, true)\|prepared.compareAndSet(false, true)' -B 3 adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncRequestBodyBridge.java adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncResponseBodyBridge.java
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncRequestBodyBridge.java-57-  @Override
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncRequestBodyBridge.java-58-  public void subscribe(Subscriber<? super ByteBuffer> subscriber) {
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncRequestBodyBridge.java-59-    Objects.requireNonNull(subscriber, "subscriber must be non-null");
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncRequestBodyBridge.java:60:    if (!subscribed.compareAndSet(false, true)) {
+--
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncResponseBodyBridge.java-54-
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncResponseBodyBridge.java-55-  @Override
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncResponseBodyBridge.java-56-  public CompletableFuture<R> prepare() {
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncResponseBodyBridge.java:57:    if (!prepared.compareAndSet(false, true)) {
+exit=0
+
+$ grep -n 'maximumBufferedBytesObserved\|S3 producer exceeded its exact bound\|MAXIMUM_CONTROL_BYTES' adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncRequestBodyBridge.java adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ConditionalObjectControlStore.java
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncRequestBodyBridge.java:38:  private final AtomicInteger maximumBufferedBytesObserved = new AtomicInteger();
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncRequestBodyBridge.java:75:  public int maximumBufferedBytesObserved() {
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncRequestBodyBridge.java:76:    return maximumBufferedBytesObserved.get();
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncRequestBodyBridge.java:135:                  throw new ObjectChunkWriteException("S3 producer exceeded its exact bound");
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3AsyncRequestBodyBridge.java:139:                maximumBufferedBytesObserved.accumulateAndGet(copy.length, Math::max);
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ConditionalObjectControlStore.java:32:  private static final int MAXIMUM_CONTROL_BYTES = 64 * 1024;
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ConditionalObjectControlStore.java:82:    if (encoded.length > MAXIMUM_CONTROL_BYTES) {
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ConditionalObjectControlStore.java:213:          || response.contentLength() > MAXIMUM_CONTROL_BYTES
+adapter/outbound/objectstorage/src/main/java/dev/caskeleton/adapter/outbound/objectstorage/s3/S3ConditionalObjectControlStore.java:239:              if (next > MAXIMUM_CONTROL_BYTES) {
+exit=0
+
+=== 8.4 test coverage ===
+$ grep -nE '@Test|  void ' adapter/outbound/objectstorage/src/test/java/dev/caskeleton/adapter/outbound/objectstorage/s3/*.java | sed 's|.*/s3/||' | head -60
+S3AsyncClientFactoryTest.java:21:  @Test
+S3AsyncClientFactoryTest.java:22:  void buildsExplicitNettyAsyncClientWithoutCrtAndOwnsCloseOrder() {
+S3AsyncClientFactoryTest.java:42:  @Test
+S3AsyncClientFactoryTest.java:43:  void assemblesRetriesV2WithExactAttemptsAndSeparateHalfJitterPaths() throws Exception {
+S3AsyncClientFactoryTest.java:66:  @Test
+S3AsyncClientFactoryTest.java:67:  void rejectsMissingNonPositiveAndContradictoryTimeoutPoolAndRetryPolicy() {
+S3AsyncClientFactoryTest.java:114:  @Test
+S3AsyncClientFactoryTest.java:115:  void rejectsUnsafeEndpointAndPartialStaticCredentialsWithoutExposingSecrets() {
+S3AsyncRequestBodyBridgeTest.java:24:  @Test
+S3AsyncRequestBodyBridgeTest.java:25:  void streamsOnceOffTheSubscriberThreadWithOneChunkOfProducerLead() throws Exception {
+S3AsyncRequestBodyBridgeTest.java:65:  @Test
+S3AsyncRequestBodyBridgeTest.java:66:  void cancellationAndDigestMismatchFailWithoutProducerReplay() throws Exception {
+S3AsyncResponseBodyBridgeTest.java:23:  @Test
+S3AsyncResponseBodyBridgeTest.java:24:  void deliversAnExactBoundedBodyOnTheWorkerAndInvalidatesTheSource() throws Exception {
+S3AsyncResponseBodyBridgeTest.java:90:  @Test
+S3AsyncResponseBodyBridgeTest.java:91:  void truncatedAndOversizedSdkChunksFailClosed() throws Exception {
+S3ConditionalObjectControlStoreTest.java:50:  @Test
+S3ConditionalObjectControlStoreTest.java:51:  void createAndCasUseExactConditionalHeadersAndPrivateEtags() {
+S3ConditionalObjectControlStoreTest.java:79:  @Test
+S3ConditionalObjectControlStoreTest.java:80:  void droppedCreateResponseResolvesByExactGetAndDigestComparison() {
+S3ConditionalObjectControlStoreTest.java:97:  @Test
+S3ConditionalObjectControlStoreTest.java:98:  void staleWriterConflictAndCorruptControlNeverBecomeAbsence() {
+S3ConditionalObjectControlStoreTest.java:121:  @Test
+S3ConditionalObjectControlStoreTest.java:122:  void exact404IsTheOnlyAbsentRead() {
+S3DirectMultipartProviderTest.java:26:  @Test
+S3DirectMultipartProviderTest.java:27:  void presignsOneExactPartWithoutReturningTheProviderUploadIdentity() throws Exception {
+S3DirectTransferProviderTest.java:43:  @Test
+S3DirectTransferProviderTest.java:44:  void signsExactChecksumMediaEncryptionLengthAndCreateOnlyPutAndVerifiesWithHead()
+S3ManagedMultipartProviderTest.java:40:  @Test
+S3ManagedMultipartProviderTest.java:41:  void mapsCreatePartAndCreateOnlyCompletionToLowLevelSdkCalls() {
+S3ManagedObjectProviderTest.java:49:  @Test
+S3ManagedObjectProviderTest.java:50:  void mapsImmutablePutAndExactHeadWithoutExposingProviderEvidence() {
+S3ManagedObjectProviderTest.java:100:  @Test
+S3ManagedObjectProviderTest.java:101:  void exactFullAndRangeReadsUseHeadEvidenceAndConditionalGet() {
+S3ManagedObjectProviderTest.java:180:  @Test
+S3ManagedObjectProviderTest.java:181:  void absentHeadIsOptionalEmpty() {
+S3ObjectOperationResolverTest.java:24:  @Test
+S3ObjectOperationResolverTest.java:25:  void resolvesDataCreateFromExactHeadEvidenceWithoutReplayingAProducer() {
+S3ObjectOperationResolverTest.java:50:  @Test
+S3ObjectOperationResolverTest.java:51:  void resolvesControlMutationOnlyFromExactRecordEvidence() {
+S3ProviderBindingTest.java:26:  @Test
+S3ProviderBindingTest.java:27:  void acceptsOnlyTheTwoFrozenProviderIdentitiesAndTheirExactVersions() {
+S3ProviderBindingTest.java:67:  @Test
+S3ProviderBindingTest.java:68:  void rejectsUnsafeOrIncompleteProviderBindingsBeforeResourceConstruction() {
+S3ProviderBindingTest.java:166:  @Test
+S3ProviderBindingTest.java:167:  void exactNamedProfileRequiresCurrentSupportedEvidence() {
+S3ProviderCompositionTest.java:31:  @Test
+S3ProviderCompositionTest.java:32:  void disabledUnselectedAndInvalidBindingsConstructNoS3Resource() {
+S3ProviderCompositionTest.java:58:  @Test
+S3ProviderCompositionTest.java:59:  void selectedExactBindingConstructsAndClosesOneOwnedClientExactlyOnce() {
+S3ProviderCompositionTest.java:80:  @Test
+S3ProviderCompositionTest.java:81:  void selectedDirectProfileConstructsAndClosesOneOwnedPresigner() {
+S3ProviderErrorMapperTest.java:16:  @Test
+S3ProviderErrorMapperTest.java:17:  void mapsStableS3FailuresWithoutLeakingProviderDetails() {
+S3ProviderErrorMapperTest.java:29:  @Test
+S3ProviderErrorMapperTest.java:30:  void finalMutationTransportFailureIsIndeterminateRatherThanAuthoritativeFailure() {
+S3ProviderQualifierTest.java:18:  @Test
+S3ProviderQualifierTest.java:19:  void staticCiEvidenceIsValidatedWithoutRunningAProbe() {
+S3ProviderQualifierTest.java:41:  @Test
+S3ProviderQualifierTest.java:42:  void startupProbeIsConfinedToAReservedPrefixAndSafeActions() {
+exit=0
+