With PCC-RO becoming generally available for 2.18.0, there is a risk that users will also consider PCC-RW as ready for production and use it on their systems. The current PCC-RW functionality is only a proof-of-concept, and poses significant risk to user data because it moves the *only copy* of the data into a single client-side cache/archive (like an hsm-released archive file). If the client becomes inaccessibe or the "cache" filesystem is cleaned up or lost, then the only copy of the file data is lost with it.

In order for PCC-RW to become suitable for production use, the HSM archive copy would need to become an FLR mirror copy (LU-13637) so that the main file copy is not released from the filesystem when it is copied into the client PCC-RW archive, along with other bug fixes, testing, etc.

Add a configuration parameter to disable the PCC-RW functionality by default in the 2.18.0 release, which is enabled during testing in sanity-pcc.sh (and possibly other scripts when needed), with a clear message about how to enable it again, as was done for FKR-ECRO and CSDC while they are under development. Add an environment variable check in lctl/lfs that causes PCC-RW commands to fail with a clear user message as the front line, and a tunable llite.*.enable_pcc_rw parameter on the client and nodemap.*.enable_pcc_rw RBAC (or mdt.*.enable_pcc_rw parameter) on the server (including the default nodemap) that prints a self-referential message on the console about how to enable it so that it can be configured on a per-nodemap basis.

We may as well add similar *.*.enable_pcc_ro parameters at the same time, but enabled by default for this release.