pgsty · Vonng · Sep 16, 2026 · Sep 16, 2026 · Sep 16, 2026
diff --git a/content/blog/release/silo-20260916.md b/content/blog/release/silo-20260916.md
@@ -0,0 +1,120 @@
+---
+title: "SILO 20260916 Release Candidate"
+linkTitle: "SILO 20260916 Release Candidate"
+date: 2026-09-16
+summary: "Preparation for the September 16 server release: current components, correctness repairs, and coordinated upgrade requirements."
+description: "Unpublished SILO 20260916000000 candidate and its component and upgrade contracts."
+author: "Vonng"
+tags: [Release]
+url: "/blog/release/silo-20260916/"
+draft: true
+---
+
+**Release preparation; not published.** The intended tag is
+`RELEASE.2026-09-16T00-00-00Z`, with package version `20260916000000.0.0`.
+The latest published Server remains [20260903](/blog/release/silo-20260903/).
+This draft does not announce a new binary, package, image, chart, or deployment.
+
+## Components {#components}
+
+| Component | Candidate selection |
+| --- | --- |
+| Server | `RELEASE.2026-09-16T00-00-00Z` (planned) |
+| Embedded Console | [v2.4.1](/blog/release/console-2.4.1/), source `1360e26d976d82eda395b0b2e449df8c9d49f39c` |
+| MC module and bundled mcli | [20260916](/blog/release/mcli-20260916/), source `e952aa78f10a2b77dd525a2b7e3143bcda0cd377` |
+| Shared package | `github.com/pgsty/silo-pkg/v3 v3.14.1` |
+| Upstream S3 SDK | `github.com/minio/minio-go/v7 v7.3.1-0.20260915093545-32e1f32cb176` |
+| JWX / strfmt / LZ4 | v3.3.0 / v0.27.2 / v4.1.30 |
+| Build toolchain | Go 1.27.1; GoReleaser 2.18.1 |
+| Helm chart | 7.0.3 (prepared; publish after the Server image) |
+
+Console and MC retain their historical Go module paths. The Server selects
+PGSTY source through immutable pseudo-versions
+`v0.0.0-20260916075814-1360e26d976d` and
+`v0.0.0-20260916070421-e952aa78f10a`, respectively. The maintained release
+combination is SILO + Console + mcli + silo-pkg. Upstream MinIO/MC compatibility
+remains best effort. Installing a standalone component does not update an
+existing Server binary or its bundled client.
+
+## Changes since Server 20260903 {#changes}
+
+- **Authorization and request validation:** restrict the anonymous Console
+  download proxy to object-content GETs on the configured S3 origin and reject
+  redirects. Close unsigned-header paths described by
+  [SN-2026-011](/blog/security/20260913-signed-header-status/). Split
+  `admin:ChangeMyPassword` from `admin:CreateUser`; saved policies are not
+  rewritten. See the [password migration guide](/compatibility/password-permissions/).
+- **IAM replication:** persist deletion revisions and parent revocation
+  boundaries, reload committed storage on peer notifications, and reject stale
+  replay of deleted identities, policies, or older grants.
+- **Conditional writes and version deletion:** evaluate ordinary multi-pool
+  PUT and multipart-completion conditions against the logical current object
+  under the object lock. Ordinary single-object version deletion reconciles
+  copies across pools. If another pool cannot verify the relevant metadata,
+  these operations can fail even while GET/HEAD succeeds elsewhere.
+- **Replication and existing metadata:** preserve object tags and their ordered
+  deletions, including SSE-KMS/SSE-C metadata paths; keep delete-marker identity
+  through MRF retries; prevent transport-only `aws-chunked` from becoming stored
+  Content-Encoding. Existing damaged replicas are not automatically repaired.
+- **Multipart listing:** retain `legacy` as the default. The opt-in
+  `MINIO_API_MULTIPART_LISTING=strict` scans durable state and applies global
+  S3 pagination. Upgrade all writers, drain legacy uploads, run read-only
+  `multipart-preflight`, and assess scan capacity before enabling it. Strict
+  cancellation requires majority acknowledgements; default cancellation keeps
+  released quorum behavior. See the [compatibility contract](/blog/design/list-multipart-uploads/#implementation).
+- **Reliability:** enforce an absolute HTTP/1 header-read deadline while keeping
+  progressing bodies under the existing idle timeout. Synchronize CPU metrics
+  reads to prevent concurrent map access from terminating the process during
+  Prometheus collection ([#210](https://github.com/pgsty/silo/issues/210)).
+- **Other accumulated storage fixes:** preserve SSE-C plaintext sizes and key
+  rotation checksums; correct encrypted/federated copies and attributes
+  pagination; retain independent Object Lock, conditional DELETE, CORS, quota,
+  resync and bucket-metadata convergence repairs. Remove the experimental
+  access-frequency pool-tiering feature while keeping ordinary lifecycle,
+  remote tiering, rebalance and decommission.
+- **Dependencies and packaging:** handle CopyObject errors embedded in HTTP 200,
+  escape JWX JSON field names, update strfmt hostname validation and LZ4 reader
+  handling, select the released Console frontend and client archives, and use
+  the same fixed GoReleaser/action in snapshot and release builds. Dependency
+  PRs run the packaging gate.
+
+The [Server changelog](https://github.com/pgsty/silo/blob/main/CHANGELOG.md) and
+[component matrix](/compatibility/versions/) provide the detailed source and
+operator boundaries. Console v2.4.1's standalone binary/package release is
+available; public image delivery is a separate gate tracked in
+[Console #34](https://github.com/pgsty/silo-console/issues/34).
+
+## Upgrade requirements {#upgrade}
+
+1. Read the [IAM upgrade and restore runbook](/operations/replication/iam-upgrade/).
+   Coordinate every participating server and site. Mixed old/new nodes sharing
+   an IAM backend and rolling downgrade are unsupported.
+2. Back up complete IAM storage and the required encryption material. A live
+   admin export omits deletion history. Reissue credentials for recreated
+   parents and reconcile pre-upgrade revocations whose history has been lost.
+3. Audit historical replicas using the
+   [metadata procedure](/operations/replication/replica-metadata-audit/).
+   Installing the candidate does not recover lost tags, undo accepted
+   overwrites, or prove historical purge convergence.
+4. Keep multipart listing in its default legacy mode unless strict-mode
+   prerequisites are satisfied. Historical persisted `multipart_listing` keys
+   are ignored and can be removed with a targeted
+   `mcli admin config reset ALIAS api multipart_listing` before rollback.
+5. For builds that used experimental access-frequency pool tiering, follow its
+   [migration notes](/compatibility/access-tiering-removal/). The feature was not
+   part of the published Server 20260903.
+
+A successful cancellation response does not prove that every drive has removed
+the upload; delayed creation writes can still restore it. Replica repairs do
+not add arbitrary clock-skew tolerance. A shorter header timeout also affects
+TLS handshake reads; it is not a total upload/download duration limit.
+
+## Acceptance boundary {#acceptance}
+
+This remains a draft until the exact candidate source and its packaged
+artifacts pass the [final integration gate](https://github.com/pgsty/silo/issues/203).
+That gate covers unit/race/build checks, both supported Linux architectures,
+embedded and standalone Console, mcli operations, real multi-process
+replication and coordinated upgrade/restore. Signed packages, checksums,
+provenance, public images, chart publication and production deployment remain
+separate deliverables. No production upgrade is performed by this preparation.
diff --git a/content/blog/release/silo-20260916.zh.md b/content/blog/release/silo-20260916.zh.md
@@ -0,0 +1,72 @@
+---
+title: "SILO 20260916 发布候选"
+linkTitle: "SILO 20260916 发布候选"
+date: 2026-09-16
+summary: "9 月 16 日服务端发布准备：最新组件、正确性修复与协调升级要求。"
+description: "尚未发布的 SILO 20260916000000 候选版本、组件组合与升级契约。"
+author: "Vonng"
+tags: [Release]
+url: "/zh/blog/release/silo-20260916/"
+draft: true
+---
+
+**发布准备中，尚未正式发布。** 计划标签为 `RELEASE.2026-09-16T00-00-00Z`，
+系统包版本为 `20260916000000.0.0`。最新正式 Server 仍是
+[20260903](/zh/blog/release/silo-20260903/)。本文草稿不表示二进制、软件包、镜像、Chart 或部署已经交付。
+
+## 组件版本 {#components}
+
+| 组件 | 候选版本选择 |
+| --- | --- |
+| Server | `RELEASE.2026-09-16T00-00-00Z`（计划） |
+| 内嵌 Console | [v2.4.1](/zh/blog/release/console-2.4.1/)，源码 `1360e26d976d82eda395b0b2e449df8c9d49f39c` |
+| MC 模块与内置 mcli | [20260916](/zh/blog/release/mcli-20260916/)，源码 `e952aa78f10a2b77dd525a2b7e3143bcda0cd377` |
+| 共享包 | `github.com/pgsty/silo-pkg/v3 v3.14.1` |
+| 上游 S3 SDK | `github.com/minio/minio-go/v7 v7.3.1-0.20260915093545-32e1f32cb176` |
+| JWX / strfmt / LZ4 | v3.3.0 / v0.27.2 / v4.1.30 |
+| 构建工具 | Go 1.27.1；GoReleaser 2.18.1 |
+| Helm Chart | 7.0.3（已准备，等待 Server 镜像后发布） |
+
+Console 与 MC 保留历史 Go 模块路径。Server 通过不可变伪版本
+`v0.0.0-20260916075814-1360e26d976d` 与
+`v0.0.0-20260916070421-e952aa78f10a` 选择 PGSTY 源码。
+正式维护与验收组合是 SILO + Console + mcli + silo-pkg；对原厂 MinIO/MC 的兼容仍为尽最大努力。
+单独升级某个组件不会替换现有 Server 二进制或镜像中的客户端。
+
+## 相对 Server 20260903 的变化 {#changes}
+
+- **授权与请求校验：** Console 匿名下载代理仅接受配置 S3 origin 上的对象内容 GET，并拒绝跳转。
+  修复 [SN-2026-011](/zh/blog/security/20260913-signed-header-status/) 中的未签名请求头路径。
+  `admin:ChangeMyPassword` 与 `admin:CreateUser` 分离，已有策略不会自动改写；见[密码权限迁移](/zh/compatibility/password-permissions/)。
+- **IAM 复制：** 持久化删除版本与父身份撤销边界；收到节点通知后重新加载已提交存储，防止旧事件重放恢复已删身份、策略与旧授权。
+- **条件写入与版本删除：** 普通多池 PUT、分片完成在现有对象锁内使用逻辑当前对象判断条件；普通单对象版本删除协调所有池中的副本。
+  其他池无法验证相关元数据时，这些操作可能失败，即使另一个池仍能提供 GET/HEAD。
+- **复制与历史元数据：** 保留对象标签与有序删除，包括 SSE-KMS/SSE-C 元数据路径；MRF 重试保留删除标记身份；阻止传输用的 `aws-chunked` 写入对象 Content-Encoding。
+  已损坏的历史副本不会自动修复。
+- **分片列举：** 默认仍为 `legacy`。显式启用 `MINIO_API_MULTIPART_LISTING=strict` 后，扫描持久化状态并执行全局 S3 分页。
+  启用前必须升级所有 writer、排空旧上传、运行只读 `multipart-preflight` 并评估扫描容量。严格取消需要多数盘确认，默认取消保留已发布版本的 quorum 行为；见[兼容契约](/zh/blog/design/list-multipart-uploads/#implementation)。
+- **可靠性：** HTTP/1 请求头使用绝对读取期限，持续进行的正文传输保留既有空闲超时。
+  CPU 指标读取增加同步，避免 Prometheus 抓取时并发访问 map 导致整个进程退出（[#210](https://github.com/pgsty/silo/issues/210)）。
+- **其他累计存储修复：** 保留 SSE-C 明文分片大小与密钥轮换校验和，修复加密/联邦复制与属性分页；保留独立的 Object Lock、条件 DELETE、CORS、配额、resync 与桶元数据收敛修复。
+  移除实验性的访问频率池间分层，普通生命周期、远端分层、再平衡和退役功能保持可用。
+- **依赖与打包：** 正确处理 HTTP 200 中嵌入的 CopyObject 错误，转义 JWX JSON 字段名，更新 strfmt 主机名校验与 LZ4 读取行为；引用已发布的 Console 前端与客户端归档；快照和正式发布使用相同的固定 GoReleaser 与 Action，仅修改依赖的 PR 也执行打包门禁。
+
+详细源码与运维边界见 [Server changelog](https://github.com/pgsty/silo/blob/main/CHANGELOG.md) 和[组件矩阵](/zh/compatibility/versions/)。
+独立 Console v2.4.1 的二进制和软件包已发布；公共镜像交付是单独的门禁，由 [Console #34](https://github.com/pgsty/silo-console/issues/34) 跟踪。
+
+## 升级要求 {#upgrade}
+
+1. 阅读 [IAM 升级与恢复手册](/zh/operations/replication/iam-upgrade/)，协调升级所有参与节点与站点。不支持共享 IAM 后端的新旧版本混跑，也不支持滚动降级。
+2. 备份完整 IAM 存储及所需加密材料。普通管理导出不包含删除历史。同名父身份重建后重新签发凭据，并核对升级前已经丢失历史的撤销记录。
+3. 按[元数据审计流程](/zh/operations/replication/replica-metadata-audit/)核对历史副本。安装候选版本不会恢复已丢标签、撤销曾经接受的覆盖写，也不能证明历史清除任务已经收敛。
+4. 满足严格模式前置条件之前，分片列举保留默认 legacy 模式。历史持久化 `multipart_listing` 配置键会被忽略；回滚前可用 `mcli admin config reset ALIAS api multipart_listing` 定向清理。
+5. 使用过实验性访问频率池间分层的构建，应遵循其[迁移说明](/zh/compatibility/access-tiering-removal/)。已发布 Server 20260903 不包含该功能。
+
+成功取消上传不代表每块盘都已完成物理清理；延迟到达的创建写入仍可能恢复上传。
+复制修复不增加任意站点时钟偏差的容忍保证。缩短请求头超时也会约束 TLS 握手读取，但它不是上传下载总时长限制。
+
+## 验收边界 {#acceptance}
+
+精确候选源码及其制品通过[最终集成门禁](https://github.com/pgsty/silo/issues/203)之前，本文保持草稿。
+验收范围包括单元/竞态/构建、Linux 双架构、内嵌与独立 Console、mcli 操作、真实多进程复制，以及协调升级与恢复。
+软件包签名、校验和、来源证明、公共镜像、Chart 发布与生产部署分别交付。本次准备不执行生产升级。
diff --git a/content/compatibility/versions.md b/content/compatibility/versions.md
@@ -63,7 +63,7 @@ a build containing them.
 | --- | --- | --- |
 | Multi-pool storage | [#188](https://github.com/pgsty/silo/pull/188)<br>[#189](https://github.com/pgsty/silo/pull/189) | Ordinary single-object version DELETE reconciles copies across pools; reconciliation preserves tag state. The opt-in GET-frequency pool-tiering feature was removed. |
 | Conditional multipart completion | [#190](https://github.com/pgsty/silo/pull/190) | Preconditions use the logical current object across all pools, preventing an older pool copy from accepting a stale ETag or rejecting the current one. |
-| Multipart discovery and cancellation | [#198](https://github.com/pgsty/silo/pull/198) | Discover persistent uploads across pools and sets, continue after native marker uploads disappear, and require majority cancellation confirmations. Strict mode requires a coordinated writer upgrade and legacy drain; see the [upgrade contract](/blog/design/list-multipart-uploads/#implementation). |
+| Multipart discovery and cancellation | [#198](https://github.com/pgsty/silo/pull/198) | Default legacy listing and cancellation retain released behavior. Opt-in strict mode discovers durable uploads across pools/sets, continues after marker uploads disappear, and requires majority cancellation acknowledgements ([#213](https://github.com/pgsty/silo/pull/213)). Strict mode requires a coordinated writer upgrade and legacy drain; see the [upgrade contract](/blog/design/list-multipart-uploads/#implementation). |
 | Ordinary conditional PUT | [#207](https://github.com/pgsty/silo/pull/207) | Public write conditions use the logical current object across all pools, including draining pools. Readability and destination-version changes are detailed [below](#conditional-put). |
 | IAM revocations | [#191](https://github.com/pgsty/silo/pull/191)<br>[#192](https://github.com/pgsty/silo/pull/192) | Peer deletion notifications reload committed state. Durable deletion versions and retained revocation boundaries prevent stale site replay from restoring revoked identities or their older grants. |
 | Replicated tags and delete markers | [#193](https://github.com/pgsty/silo/pull/193)<br>[#196](https://github.com/pgsty/silo/pull/196) | SSE-KMS copies preserve tag revision times; tag deletion advances its revision and resists delayed events. Delete-marker purges retain their identity and retry state through MRF recovery. |

diff --git a/content/compatibility/versions.zh.md b/content/compatibility/versions.zh.md
@@ -56,7 +56,7 @@ Console 嵌入前端已按此依赖图重新构建。历史 Go 模块路径没
 | --- | --- | --- |
 | <span style="white-space:nowrap">多池存储</span> | [#188](https://github.com/pgsty/silo/pull/188)<br>[#189](https://github.com/pgsty/silo/pull/189) | 普通单对象版本 DELETE 协调各池副本，副本协调保留标签状态；移除可选的 GET 访问频率池间分层功能。 |
 | <span style="white-space:nowrap">分片完成条件</span> | [#190](https://github.com/pgsty/silo/pull/190) | 前置条件使用所有池中的逻辑最新对象，避免旧副本接受过期 ETag，或拒绝当前 ETag。 |
-| <span style="white-space:nowrap">分片发现与取消</span> | [#198](https://github.com/pgsty/silo/pull/198) | 跨 pool/set 发现持久上传，原生 marker 对应上传消失后仍能续页，取消需要多数盘确认。严格模式要求所有 writer 升级并排空旧上传，见[升级契约](/zh/blog/design/list-multipart-uploads/#implementation)。 |
+| <span style="white-space:nowrap">分片发现与取消</span> | [#198](https://github.com/pgsty/silo/pull/198) | 默认 legacy 列举与取消保留已发布行为。显式启用严格模式后，跨 pool/set 发现持久上传、在 marker 上传消失后继续分页，并要求多数盘确认取消（[#213](https://github.com/pgsty/silo/pull/213)）。严格模式要求所有 writer 升级并排空旧上传，见[升级契约](/zh/blog/design/list-multipart-uploads/#implementation)。 |
 | <span style="white-space:nowrap">普通条件 PUT</span> | [#207](https://github.com/pgsty/silo/pull/207) | 公开写入条件使用所有池中的逻辑当前对象，包括正在退役或再平衡的池；可读性及目标版本行为变化见[下文](#conditional-put)。 |
 | <span style="white-space:nowrap">IAM 撤销</span> | [#191](https://github.com/pgsty/silo/pull/191)<br>[#192](https://github.com/pgsty/silo/pull/192) | 节点间删除通知重新加载已提交状态；持久化删除版本与撤销边界，防止旧站点事件重放恢复已撤销身份或旧授权。 |
 | <span style="white-space:nowrap">标签与删除标记</span> | [#193](https://github.com/pgsty/silo/pull/193)<br>[#196](https://github.com/pgsty/silo/pull/196) | SSE-KMS 复制保留标签修订时间；删除标签推进修订并抵御延迟事件；删除标记清除在 MRF 恢复时保留标记身份和重试状态。 |

diff --git a/content/operations/replication/iam-upgrade.md b/content/operations/replication/iam-upgrade.md
@@ -171,7 +171,14 @@ The isolated object-store and etcd rehearsals passed this policy with the
 credential checks below. Apply the same checks to the actual recovery group
 before approving access.
 
-The following shows the operations against a protected recovery alias. Replace
+Check and apply reconciliation at **every restored site**. A successful command
+at one site does not prove that the others applied it. After restoring an old
+object-store snapshot with its old binaries, do not rely on site replication
+alone to propagate revocations. Confirm already-removed service keys are absent,
+keep replacement identities and credentials consistent across the recovery
+group, and require the per-process credential checks below before opening access.
+
+The following shows the operations against one protected recovery alias. Replace
 the uppercase names with reviewed entries. User creation prompts for a secret;
 service-account creation prints credentials, which belong in the approved
 secret store rather than the rehearsal log.