docs(changelog): sync unreleased decommission, tagging and replication notes

Align unreleased server notes with main commits 293ab78b4 and 8587e061b and the completed site-replication topology snapshot, pooled copy rewrite, and batch KMS UTF-8 fixes.

Signed-off-by: Feng Ruohang <rh@vonng.com>

CHANGELOG.md

@@ -14,10 +14,12 @@ for the candidate behavior and upgrade boundaries.
   GOVERNANCE retention and legal hold remain possible. Local lock revisions
   advance past stored revisions, and forced prefix deletion refuses an
   unavailable Object Lock configuration ([#336](https://github.com/pgsty/silo/issues/336)).
-- Tagging proxies authenticate and authorize every addressed destination,
+- Tagging proxies (`GET`, `PUT` and `DELETE`) authenticate and authorize every
-  including its stored tags. Authenticated unsigned-trailer uploads enforce
+  present replica, including its stored tags, fail closed on unreadable targets,
-  the request time window; anonymous uploads allowed by bucket policy remain
+  and skip missing replicas caused by replication lag unless all targets are
-  supported ([#337](https://github.com/pgsty/silo/issues/337),
+  absent. Authenticated unsigned-trailer uploads enforce the request time
+  window; anonymous uploads allowed by bucket policy remain supported
+  ([#337](https://github.com/pgsty/silo/issues/337),
   [#338](https://github.com/pgsty/silo/issues/338)).
 - `GetObjectAttributes` evaluates both Attributes and GetObject permissions
   against the addressed version's stored tags, using version actions for an
@@ -34,27 +36,36 @@ for the candidate behavior and upgrade boundaries.
   versions are actually removed, resolving the 20261109 limitation recorded
   in [#293](https://github.com/pgsty/silo/issues/293). Decommission and rebalance
   clean up successfully migrated sibling versions after concurrent deletion
-  of another version. Unreadable or conflicting metadata is not proof of
+  of another version. Source-removal and final empty verification check every
-  absence; cancellation returns an error, and a scan without physical progress
+  online drive and tolerate offline drives within the erasure set's read quorum,
-  stops. Free-version tier ownership and the final physical-empty check remain
+  while rejecting online metadata remnants, corrupt metadata, directory errors
-  protected ([#340](https://github.com/pgsty/silo/issues/340)). See the
+  and drive outages beyond parity. Cancellation returns an error, and a scan
+  without physical progress stops. Free-version tier ownership and the final
+  physical-empty check remain protected
+  ([#340](https://github.com/pgsty/silo/issues/340)). See the
   [decommission procedure](https://silo.pgsty.com/operations/deployments/baremetal-decommission-server-pool/).
-- Site-replication healing releases its state read lock before storage reads
+- Site-replication bucket healing, metadata healing, status collection and
-  and replication hooks, avoiding a deadlock when a writer is waiting
+  replication hooks snapshot site topology and release the state read lock
+  before storage I/O and peer RPCs, avoiding deadlocks and state-map races
+  when a configuration writer is waiting
   ([#341](https://github.com/pgsty/silo/issues/341)). IAM import preserves
   disabled service accounts and groups, reports group failures, and excludes
   derived session-policy claims from exported and replicated credentials
   ([#345](https://github.com/pgsty/silo/issues/345)).
 - Historical-version self-copy plans its destination pool and data rewrite
-  before encryption or compression, so a source version in another pool can
+  before encryption or compression, preserving multi-block compression seek
-  create a readable new version. In-place metadata updates locate the exact
+  indexes so a source version in another pool creates a readable new version.
-  requested version ([#343](https://github.com/pgsty/silo/issues/343)). Restore
+  In-place metadata updates locate the exact requested version and preserve
-  expiry no longer turns a time-derived data-directory flag into a different
+  authoritative content on moving pools, while copies that require encryption
-  version revision; mixed healed headers can reach quorum and expired local
+  or checksum recomputation select an active pool
-  restore data can be cleaned up ([#344](https://github.com/pgsty/silo/issues/344)).
+  ([#343](https://github.com/pgsty/silo/issues/343)). Restore expiry no longer
+  turns a time-derived data-directory flag into a different version revision;
+  mixed healed headers can reach quorum and expired local restore data can be
+  cleaned up ([#344](https://github.com/pgsty/silo/issues/344)).
 - Batch KMS rotation decodes the configured encryption context on execution
-  and after reload or retry, without adding validation-probe fields to object
+  and after reload or retry, rejecting invalid UTF-8 before changing an object
-  metadata ([#346](https://github.com/pgsty/silo/issues/346)). Batch variable
+  key and without adding validation-probe fields to object metadata
+  ([#346](https://github.com/pgsty/silo/issues/346)). Batch variable
   preflight follows the pinned policy evaluator's literal and substitution
   rules, including BinaryEquals, while retaining refusal of unavailable
   request context. This does not add AWS special-variable escape semantics