diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
index ed3b03860..93cfc1ed0 100644
--- a/CONTRIBUTORS.md
+++ b/CONTRIBUTORS.md
@@ -2,7 +2,7 @@
 
 SILO is built by **40 community contributors**, including its maintainers. This record covers every
 human author who has opened an issue or pull request in the repositories listed below, in any state.
-It was checked against the complete, paginated GitHub API records on **2026-09-07**.
+It was checked against the complete, paginated GitHub API records on **2026-09-07 03:00:14 UTC**.
 
 Contributors appear once in the avatar wall: authors of merged PRs first, other PR authors next,
 and issue-only authors after them. Within each group, substantial features, security and correctness
@@ -59,7 +59,7 @@ the Git history and [NOTICE](NOTICE); this record covers activity in the PGSTY r
 
 | Contributor | Contribution | Record |
 | :-- | :-- | :-- |
-| [@Vonng](https://github.com/Vonng) | Maintains SILO, Console, mcli, shared packages, releases, and documentation | 84 merged PRs across five repositories; [complete maintainer record](#maintainer-record) |
+| [@Vonng](https://github.com/Vonng) | Maintains SILO, Console, mcli, shared packages, releases, and documentation | 85 merged PRs across five repositories; [complete maintainer record](#maintainer-record) |
 | [@h5vx](https://github.com/h5vx) | Implemented per-bucket CORS configuration and enforcement | [pgsty/silo#71](https://github.com/pgsty/silo/pull/71) — Merged ([e4e3007da](https://github.com/pgsty/silo/commit/e4e3007da6d7d1198a6a050e34f84566d40a9654)) |
 | [@mrjavadseydi](https://github.com/mrjavadseydi) | Fixed effective bucket quota metrics; proposed access-frequency ILM | [pgsty/silo#132](https://github.com/pgsty/silo/pull/132) — Merged ([ad873c735](https://github.com/pgsty/silo/commit/ad873c73571b121293791f13f8dc46ddf5264d60))<br>[pgsty/silo#60](https://github.com/pgsty/silo/pull/60) — Open |
 | [@Dansyuqri](https://github.com/Dansyuqri) | Added ChecksumType to multipart completion responses | [pgsty/silo#57](https://github.com/pgsty/silo/pull/57) — Merged ([a96116b12](https://github.com/pgsty/silo/commit/a96116b128bbf2aa42f85eafbf75eb6636cd36ee)) |
@@ -129,7 +129,7 @@ also checked for community submissions.
 
 | Repository | Issues | Pull requests |
 | :-- | --: | --: |
-| [pgsty/silo](https://github.com/pgsty/silo) | 82 | 60 |
+| [pgsty/silo](https://github.com/pgsty/silo) | 82 | 61 |
 | [pgsty/silo-console](https://github.com/pgsty/silo-console) | 34 | 10 |
 | [pgsty/mc](https://github.com/pgsty/mc) | 18 | 17 |
 | [pgsty/silo-pkg](https://github.com/pgsty/silo-pkg) | 0 | 3 |
@@ -137,16 +137,16 @@ also checked for community submissions.
 | [pgsty/kes](https://github.com/pgsty/kes) | 0 | 0 |
 | [pgsty/silo.pgsty.com](https://github.com/pgsty/silo.pgsty.com) | 1 | 11 |
 | [pgsty/minio-docs](https://github.com/pgsty/minio-docs) | 0 | 0 |
-| **Total** | **135** | **101** |
+| **Total** | **135** | **102** |
 
 ## Maintainer record
 
 <details>
-<summary>@Vonng — 84 merged PRs and 101 issues</summary>
+<summary>@Vonng — 85 merged PRs and 101 issues</summary>
 
 ### pgsty/silo
 
-**Merged PRs (45):** [pgsty/silo#44](https://github.com/pgsty/silo/pull/44 "helm: harden Silo chart delivery"), [pgsty/silo#45](https://github.com/pgsty/silo/pull/45 "helm: trim hardening to essentials"), [pgsty/silo#56](https://github.com/pgsty/silo/pull/56 "docs: adopt no-CLA + DCO policy and fix copyright terms"), [pgsty/silo#66](https://github.com/pgsty/silo/pull/66 "fix: checksum CopyObject data before compression"), [pgsty/silo#69](https://github.com/pgsty/silo/pull/69 "fix: preserve transform state on metadata-only copies"), [pgsty/silo#70](https://github.com/pgsty/silo/pull/70 "fix: return checksums from CopyObject"), [pgsty/silo#72](https://github.com/pgsty/silo/pull/72 "fix: return the remote part checksum to federated UploadPartCopy"), [pgsty/silo#73](https://github.com/pgsty/silo/pull/73 "fix: authorize user status changes by target status"), [pgsty/silo#74](https://github.com/pgsty/silo/pull/74 "fix: align multipart completion checksum errors"), [pgsty/silo#80](https://github.com/pgsty/silo/pull/80 "fix: complete per-bucket CORS release hardening"), [pgsty/silo#81](https://github.com/pgsty/silo/pull/81 "test: cover asymmetric CORS site counts"), [pgsty/silo#85](https://github.com/pgsty/silo/pull/85 "fix: restore pre-release server corrections"), [pgsty/silo#86](https://github.com/pgsty/silo/pull/86 "fix: keep rewritten CopyObject data and metadata consistent"), [pgsty/silo#87](https://github.com/pgsty/silo/pull/87 "fix: authenticate SSE-C keys on zero-byte reads"), [pgsty/silo#88](https://github.com/pgsty/silo/pull/88 "fix: skip bucket CORS lookup without an origin"), [pgsty/silo#89](https://github.com/pgsty/silo/pull/89 "fix: replicate object lock config in its own field"), [pgsty/silo#90](https://github.com/pgsty/silo/pull/90 "fix: preserve bucket configs during site adoption"), [pgsty/silo#91](https://github.com/pgsty/silo/pull/91 "fix: report site replication metadata per site"), [pgsty/silo#92](https://github.com/pgsty/silo/pull/92 "fix: reject unsupported checksum assertions"), [pgsty/silo#93](https://github.com/pgsty/silo/pull/93 "fix: reject composite CRC64NVME checksums"), [pgsty/silo#94](https://github.com/pgsty/silo/pull/94 "ci: make server release retries tag-idempotent"), [pgsty/silo#95](https://github.com/pgsty/silo/pull/95 "fix: authenticate SSE-C for object attributes"), [pgsty/silo#96](https://github.com/pgsty/silo/pull/96 "fix: reject composite CRC64NVME completion"), [pgsty/silo#97](https://github.com/pgsty/silo/pull/97 "deps: pin reviewed pre-release components"), [pgsty/silo#98](https://github.com/pgsty/silo/pull/98 "fix: authorize SSE-C attribute reads by replication permission"), [pgsty/silo#101](https://github.com/pgsty/silo/pull/101 "fix: harden CORS and replication request trust"), [pgsty/silo#103](https://github.com/pgsty/silo/pull/103 "fix: serialize whole-record bucket metadata updates"), [pgsty/silo#104](https://github.com/pgsty/silo/pull/104 "fix: authorize explicit version deletes with DeleteObjectVersion"), [pgsty/silo#121](https://github.com/pgsty/silo/pull/121 "fix: return 500 for unreadable objects instead of 206"), [pgsty/silo#122](https://github.com/pgsty/silo/pull/122 "fix: store raw SSE-C replicas verbatim on the destination"), [pgsty/silo#123](https://github.com/pgsty/silo/pull/123 "fix: honor a requested checksum algorithm on SSE-C key rotation"), [pgsty/silo#124](https://github.com/pgsty/silo/pull/124 "fix: record plaintext part sizes for replicated SSE-C multipart parts"), [pgsty/silo#126](https://github.com/pgsty/silo/pull/126 "fix: exclude SSE-C objects from compression"), [pgsty/silo#127](https://github.com/pgsty/silo/pull/127 "fix: include per-bucket CORS in bucket metadata export and import"), [pgsty/silo#128](https://github.com/pgsty/silo/pull/128 "fix: report logical part sizes and end pagination correctly in GetObjectAttributes"), [pgsty/silo#129](https://github.com/pgsty/silo/pull/129 "fix: order value-less replicated Object Lock updates by timestamp"), [pgsty/silo#130](https://github.com/pgsty/silo/pull/130 "docs: describe the startup readiness window of the health probes"), [pgsty/silo#131](https://github.com/pgsty/silo/pull/131 "fix: stop re-replicating an object whose retention was removed"), [pgsty/silo#134](https://github.com/pgsty/silo/pull/134 "fix: retransmit and re-order Object Lock for SSE-C replicas (single erasure set)"), [pgsty/silo#135](https://github.com/pgsty/silo/pull/135 "test: reconcile encrypted-parts attributes test with #119 write validation"), [pgsty/silo#138](https://github.com/pgsty/silo/pull/138 "fix: persist an honest resync terminal status about object counts"), [pgsty/silo#140](https://github.com/pgsty/silo/pull/140 "fix: count resync success by replication outcome, not target existence"), [pgsty/silo#142](https://github.com/pgsty/silo/pull/142 "fix: scope resync worker dispatch to the target being resynced"), [pgsty/silo#143](https://github.com/pgsty/silo/pull/143 "fix: honor a header-delivered checksum advertised as a chunked trailer"), [pgsty/silo#145](https://github.com/pgsty/silo/pull/145 "fix: support conditional DeleteObject (If-Match) with atomic precondition").
+**Merged PRs (46):** [pgsty/silo#44](https://github.com/pgsty/silo/pull/44 "helm: harden Silo chart delivery"), [pgsty/silo#45](https://github.com/pgsty/silo/pull/45 "helm: trim hardening to essentials"), [pgsty/silo#56](https://github.com/pgsty/silo/pull/56 "docs: adopt no-CLA + DCO policy and fix copyright terms"), [pgsty/silo#66](https://github.com/pgsty/silo/pull/66 "fix: checksum CopyObject data before compression"), [pgsty/silo#69](https://github.com/pgsty/silo/pull/69 "fix: preserve transform state on metadata-only copies"), [pgsty/silo#70](https://github.com/pgsty/silo/pull/70 "fix: return checksums from CopyObject"), [pgsty/silo#72](https://github.com/pgsty/silo/pull/72 "fix: return the remote part checksum to federated UploadPartCopy"), [pgsty/silo#73](https://github.com/pgsty/silo/pull/73 "fix: authorize user status changes by target status"), [pgsty/silo#74](https://github.com/pgsty/silo/pull/74 "fix: align multipart completion checksum errors"), [pgsty/silo#80](https://github.com/pgsty/silo/pull/80 "fix: complete per-bucket CORS release hardening"), [pgsty/silo#81](https://github.com/pgsty/silo/pull/81 "test: cover asymmetric CORS site counts"), [pgsty/silo#85](https://github.com/pgsty/silo/pull/85 "fix: restore pre-release server corrections"), [pgsty/silo#86](https://github.com/pgsty/silo/pull/86 "fix: keep rewritten CopyObject data and metadata consistent"), [pgsty/silo#87](https://github.com/pgsty/silo/pull/87 "fix: authenticate SSE-C keys on zero-byte reads"), [pgsty/silo#88](https://github.com/pgsty/silo/pull/88 "fix: skip bucket CORS lookup without an origin"), [pgsty/silo#89](https://github.com/pgsty/silo/pull/89 "fix: replicate object lock config in its own field"), [pgsty/silo#90](https://github.com/pgsty/silo/pull/90 "fix: preserve bucket configs during site adoption"), [pgsty/silo#91](https://github.com/pgsty/silo/pull/91 "fix: report site replication metadata per site"), [pgsty/silo#92](https://github.com/pgsty/silo/pull/92 "fix: reject unsupported checksum assertions"), [pgsty/silo#93](https://github.com/pgsty/silo/pull/93 "fix: reject composite CRC64NVME checksums"), [pgsty/silo#94](https://github.com/pgsty/silo/pull/94 "ci: make server release retries tag-idempotent"), [pgsty/silo#95](https://github.com/pgsty/silo/pull/95 "fix: authenticate SSE-C for object attributes"), [pgsty/silo#96](https://github.com/pgsty/silo/pull/96 "fix: reject composite CRC64NVME completion"), [pgsty/silo#97](https://github.com/pgsty/silo/pull/97 "deps: pin reviewed pre-release components"), [pgsty/silo#98](https://github.com/pgsty/silo/pull/98 "fix: authorize SSE-C attribute reads by replication permission"), [pgsty/silo#101](https://github.com/pgsty/silo/pull/101 "fix: harden CORS and replication request trust"), [pgsty/silo#103](https://github.com/pgsty/silo/pull/103 "fix: serialize whole-record bucket metadata updates"), [pgsty/silo#104](https://github.com/pgsty/silo/pull/104 "fix: authorize explicit version deletes with DeleteObjectVersion"), [pgsty/silo#121](https://github.com/pgsty/silo/pull/121 "fix: return 500 for unreadable objects instead of 206"), [pgsty/silo#122](https://github.com/pgsty/silo/pull/122 "fix: store raw SSE-C replicas verbatim on the destination"), [pgsty/silo#123](https://github.com/pgsty/silo/pull/123 "fix: honor a requested checksum algorithm on SSE-C key rotation"), [pgsty/silo#124](https://github.com/pgsty/silo/pull/124 "fix: record plaintext part sizes for replicated SSE-C multipart parts"), [pgsty/silo#126](https://github.com/pgsty/silo/pull/126 "fix: exclude SSE-C objects from compression"), [pgsty/silo#127](https://github.com/pgsty/silo/pull/127 "fix: include per-bucket CORS in bucket metadata export and import"), [pgsty/silo#128](https://github.com/pgsty/silo/pull/128 "fix: report logical part sizes and end pagination correctly in GetObjectAttributes"), [pgsty/silo#129](https://github.com/pgsty/silo/pull/129 "fix: order value-less replicated Object Lock updates by timestamp"), [pgsty/silo#130](https://github.com/pgsty/silo/pull/130 "docs: describe the startup readiness window of the health probes"), [pgsty/silo#131](https://github.com/pgsty/silo/pull/131 "fix: stop re-replicating an object whose retention was removed"), [pgsty/silo#134](https://github.com/pgsty/silo/pull/134 "fix: retransmit and re-order Object Lock for SSE-C replicas (single erasure set)"), [pgsty/silo#135](https://github.com/pgsty/silo/pull/135 "test: reconcile encrypted-parts attributes test with #119 write validation"), [pgsty/silo#138](https://github.com/pgsty/silo/pull/138 "fix: persist an honest resync terminal status about object counts"), [pgsty/silo#140](https://github.com/pgsty/silo/pull/140 "fix: count resync success by replication outcome, not target existence"), [pgsty/silo#142](https://github.com/pgsty/silo/pull/142 "fix: scope resync worker dispatch to the target being resynced"), [pgsty/silo#143](https://github.com/pgsty/silo/pull/143 "fix: honor a header-delivered checksum advertised as a chunked trailer"), [pgsty/silo#145](https://github.com/pgsty/silo/pull/145 "fix: support conditional DeleteObject (If-Match) with atomic precondition"), [pgsty/silo#146](https://github.com/pgsty/silo/pull/146 "fix: keep embedded Console login working over loopback TLS (#108)").
 
 **Issues (49):** [pgsty/silo#22](https://github.com/pgsty/silo/issues/22 "[Security] CVE-2026-33322: JWT Algorithm Confusion in OIDC Authentication"), [pgsty/silo#23](https://github.com/pgsty/silo/issues/23 "[Security] CVE-2026-33419: LDAP Login Brute-Force via User Enumeration and Missing Rate Limit"), [pgsty/silo#24](https://github.com/pgsty/silo/issues/24 "[Security] CVE-2026-34204: SSE Metadata Injection via Replication Headers (Targeted DoS)"), [pgsty/silo#25](https://github.com/pgsty/silo/issues/25 "[Security] CVE-2026-39414: Denial of Service via Unbounded Memory Allocation in S3 Select CSV Parsing"), [pgsty/silo#26](https://github.com/pgsty/silo/issues/26 "[Security] CVE-2026-32285: Potential vulnerability in third-party dependency github.com/buger/jsonparser v1.1.2"), [pgsty/silo#27](https://github.com/pgsty/silo/issues/27 "[Security] GHSA-hv4r-mvr4-25vw: Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads"), [pgsty/silo#28](https://github.com/pgsty/silo/issues/28 "[Security] GHSA-9c4q-hq6p-c237: Unauthenticated Object Write via Missing Signature Verification in Snowball Auto-Extract"), [pgsty/silo#46](https://github.com/pgsty/silo/issues/46 "UploadPart requires a per-part checksum header that AWS S3 computes server-side"), [pgsty/silo#47](https://github.com/pgsty/silo/issues/47 "CompleteMultipartUpload response omits ChecksumType"), [pgsty/silo#48](https://github.com/pgsty/silo/issues/48 "CompleteMultipartUpload checksum failures return non-AWS error codes"), [pgsty/silo#49](https://github.com/pgsty/silo/issues/49 "CompleteMultipartUpload accepts duplicate part numbers and assembles the part twice"), [pgsty/silo#50](https://github.com/pgsty/silo/issues/50 "CRC64NVME + COMPOSITE is silently canonicalised to FULL_OBJECT instead of rejected"), [pgsty/silo#52](https://github.com/pgsty/silo/issues/52 "ReadParts panics on an empty part list, stranding a keep-alive goroutine per storage-REST request"), [pgsty/silo#53](https://github.com/pgsty/silo/issues/53 "Migrating a Postgres or MySQL notify config disables all bucket notifications"), [pgsty/silo#55](https://github.com/pgsty/silo/issues/55 "Release image declares VOLUME ['/data'] but never creates it, so every non-root run fails storage init"), [pgsty/silo#63](https://github.com/pgsty/silo/issues/63 "CopyObject server-side checksum can cover transformed data when compression is enabled"), [pgsty/silo#64](https://github.com/pgsty/silo/issues/64 "Federated UploadPartCopy cannot reliably return the remote computed part checksum"), [pgsty/silo#65](https://github.com/pgsty/silo/issues/65 "MINIO_CONFIG_ENV_FILE silently ignores assignments with spaces around ="), [pgsty/silo#67](https://github.com/pgsty/silo/issues/67 "Metadata-only CopyObject can stamp compression metadata without rewriting data"), [pgsty/silo#68](https://github.com/pgsty/silo/issues/68 "CopyObjectResult omits checksum fields and minio-go drops them"), [pgsty/silo#75](https://github.com/pgsty/silo/issues/75 "Harden per-bucket CORS replication, recovery, and compatibility after #71"), [pgsty/silo#76](https://github.com/pgsty/silo/issues/76 "Fix Object Lock metadata field in site-replication initial sync"), [pgsty/silo#77](https://github.com/pgsty/silo/issues/77 "Audit site-replication source timestamps, tombstones, and per-site counters"), [pgsty/silo#78](https://github.com/pgsty/silo/issues/78 "Preserve existing Object Lock retention during site-replication bucket adoption"), [pgsty/silo#82](https://github.com/pgsty/silo/issues/82 "Zero-byte SSE-C objects never authenticate the customer key"), [pgsty/silo#83](https://github.com/pgsty/silo/issues/83 "Metadata-only CopyObject of a null version rewrites the data and leaves the metadata inconsistent"), [pgsty/silo#84](https://github.com/pgsty/silo/issues/84 "GetObjectAttributes does not authenticate the SSE-C key"), [pgsty/silo#99](https://github.com/pgsty/silo/issues/99 "Federated CopyObject silently ignores a requested checksum algorithm"), [pgsty/silo#100](https://github.com/pgsty/silo/issues/100 "Federated CopyObject rejects any source object stored inline"), [pgsty/silo#102](https://github.com/pgsty/silo/issues/102 "Serialize whole-record bucket metadata updates across config types"), [pgsty/silo#105](https://github.com/pgsty/silo/issues/105 "Audit residual bucket-metadata delete/update and cache ordering"), [pgsty/silo#109](https://github.com/pgsty/silo/issues/109 "[P1] SSE-C replicas become unreadable with destination default encryption or compression"), [pgsty/silo#110](https://github.com/pgsty/silo/issues/110 "[P1] Unreadable-object errors return HTTP 206 and are accepted as successful reads"), [pgsty/silo#111](https://github.com/pgsty/silo/issues/111 "[P1] Empty Object Lock replication updates bypass ordering and erase newer object state"), [pgsty/silo#112](https://github.com/pgsty/silo/issues/112 "[P2] Bucket metadata export/import silently loses per-bucket CORS configuration"), [pgsty/silo#113](https://github.com/pgsty/silo/issues/113 "[P2] In-place SSE-C key rotation ignores a requested checksum algorithm"), [pgsty/silo#114](https://github.com/pgsty/silo/issues/114 "[P2] GetObjectAttributes reports physical sizes for compressed or encrypted multipart parts"), [pgsty/silo#115](https://github.com/pgsty/silo/issues/115 "[P2] GetObjectAttributes pagination cannot finish with sparse multipart part numbers"), [pgsty/silo#116](https://github.com/pgsty/silo/issues/116 "[P2] Four-node restart reports online before every coordinator can read and write"), [pgsty/silo#117](https://github.com/pgsty/silo/issues/117 "[P2] Retention-removal replication mishandles empty-value and timestamp-only state"), [pgsty/silo#118](https://github.com/pgsty/silo/issues/118 "[P2] A compressed SSE-C object replicates to a replica that decrypts to an S2 stream"), [pgsty/silo#119](https://github.com/pgsty/silo/issues/119 "[P1] Replicated SSE-C multipart parts record the ciphertext length, corrupting part-number reads and later the object size"), [pgsty/silo#120](https://github.com/pgsty/silo/issues/120 "[P1] Existing SSE-C replicas cannot always be updated or repaired"), [pgsty/silo#133](https://github.com/pgsty/silo/issues/133 "[P2] Multi-pool: replica-write Object Lock reconciliation is not authoritative across server pools"), [pgsty/silo#136](https://github.com/pgsty/silo/issues/136 "[P2] Resync publishes Completed before the final object counters are persisted"), [pgsty/silo#137](https://github.com/pgsty/silo/issues/137 "resync cancellation robustness: dispatch deadlock, walker leak, and per-bucket cancel routing"), [pgsty/silo#139](https://github.com/pgsty/silo/issues/139 "[P2] Resync counts an existing replica as successful even when its update failed"), [pgsty/silo#141](https://github.com/pgsty/silo/issues/141 "resync worker dispatch is any-target, not scoped to the resync ARN"), [pgsty/silo#144](https://github.com/pgsty/silo/issues/144 "conditional DeleteObject (If-Match) is atomic only within a single erasure set").