docs(volume-server): record native malformed-fid parity milestone

rust/volume_server/DEV_PLAN.md

@@ -25,6 +25,8 @@ Implement a native Rust volume server that replicates Go volume-server behavior
 - Native Rust control-surface parity now also includes:
   - `/healthz` status mirroring from backend state transitions (e.g. leave/stopping => `503`)
   - absolute-form HTTP request-target normalization before native route matching
+- Native Rust HTTP data-path prevalidation now includes:
+  - early malformed vid/fid rejection (`400`) for GET/HEAD/POST/PUT fid-route shapes before delegation
 - Native Rust API/storage handlers are not implemented yet.
 
 ## Parity Exit Criteria
@@ -205,3 +207,13 @@ Implement a native Rust volume server that replicates Go volume-server behavior
   - `env VOLUME_SERVER_IMPL=rust VOLUME_SERVER_RUST_MODE=native go test -count=1 ./test/volume_server/http/...`
   - `env VOLUME_SERVER_IMPL=rust VOLUME_SERVER_RUST_MODE=native go test -count=1 ./test/volume_server/grpc/...`
 - Commits: `d6ff6ed6d`
+
+- Date: 2026-02-16
+- Change: Added native malformed fid-route validation in `native` mode:
+  - GET/HEAD/POST/PUT requests matching fid URL shapes now return Rust-native `400 Bad Request` for invalid vid/fid tokens
+  - valid fid-route requests still delegate to backend handlers for storage/data execution paths
+- Validation:
+  - `env VOLUME_SERVER_IMPL=rust VOLUME_SERVER_RUST_MODE=native go test -count=1 ./test/volume_server/http -run '^TestInvalidReadPathReturnsBadRequest$|^TestWriteInvalidVidAndFidReturnBadRequest$|^TestMalformedVidFidPathReturnsBadRequest$|^TestDownloadLimitInvalidVidWhileOverLimitReturnsBadRequest$'`
+  - `env VOLUME_SERVER_IMPL=rust VOLUME_SERVER_RUST_MODE=native go test -count=1 ./test/volume_server/http/...`
+  - `env VOLUME_SERVER_IMPL=rust VOLUME_SERVER_RUST_MODE=native go test -count=1 ./test/volume_server/grpc/...`
+- Commits: `1ce0174b2`

test/volume_server/DEV_PLAN.md

@@ -1311,3 +1311,10 @@ Update this section during implementation:
 - Profiles covered: full existing HTTP/gRPC integration matrix in native mode (`VOLUME_SERVER_IMPL=rust`, `VOLUME_SERVER_RUST_MODE=native`).
 - Gaps introduced/remaining: core HTTP data handlers and all gRPC RPC handlers are still delegated and remain the primary native implementation gap.
 - Commit: `d6ff6ed6d`
+
+- Date: 2026-02-16
+- Change: Added Rust-native malformed fid-route validation ahead of delegated data handlers.
+- APIs covered: GET/HEAD/POST/PUT fid-shaped paths now return native `400` for invalid vid/fid tokens (including invalid-read and invalid-write path variants) while valid routes continue through delegated storage handlers.
+- Profiles covered: full existing HTTP/gRPC integration matrix in native mode, plus targeted invalid-path parity runs.
+- Gaps introduced/remaining: data-path success branches and all gRPC handler bodies remain delegated; native replacement work continues on those core execution paths.
+- Commit: `1ce0174b2`