fix: never record a resident bucket as a CORS load failure

A bucket that is resident keeps its last loaded metadata through a failed
refresh, exactly like every other bucket configuration, so the load-failure
set only ever holds buckets that were never loaded. This makes the CORS
lookup's precedence explicit: resident document first, fail-closed only for
a bucket that has no loaded document.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PvgysXDmhPBBimCReYtA8q
Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/bucket-cors-middleware_test.go

@@ -711,3 +711,33 @@ func testBucketCorsLoadFailedBucketFailsClosed(obj ObjectLayer, _ string, _ stri
 		t.Fatalf("load-failed CORS lookup performed %d synchronous bucket metadata reads", got)
 	}
 }
+
+// TestBucketCorsResidentConfigSurvivesRefreshFailure: a resident bucket keeps
+// its last loaded CORS configuration through a failed refresh, like every
+// other bucket configuration, and the failure set never records a resident
+// bucket. Only a bucket that was never loaded fails closed.
+func TestBucketCorsResidentConfigSurvivesRefreshFailure(t *testing.T) {
+	ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{
+		t:          t,
+		objAPITest: testBucketCorsResidentConfigSurvivesRefreshFailure,
+		endpoints:  []string{"GetBucketCors"},
+	})
+}
+
+func testBucketCorsResidentConfigSurvivesRefreshFailure(obj ObjectLayer, _ string, bucket string, _ http.Handler, _ auth.Credentials, t *testing.T) {
+	if _, err := updateLocalBucketCORSMetadata(t.Context(), obj, bucket, []byte(testSiteReplicationCORSDoc)); err != nil {
+		t.Fatal(err)
+	}
+	sys := globalBucketMetadataSys
+	sys.Lock()
+	sys.noteLoadFailure(bucket)
+	_, marked := sys.loadFailed[bucket]
+	sys.Unlock()
+	if marked {
+		t.Fatal("a resident bucket was recorded as a load failure")
+	}
+	cfg, _, err := sys.GetResidentCorsConfig(bucket)
+	if err != nil || cfg == nil {
+		t.Fatalf("resident CORS configuration lost after a refresh failure: cfg=%v err=%v", cfg, err)
+	}
+}