ci: refresh README repository cards daily at 00:00 UTC

Signed-off-by: Feng Ruohang <rh@vonng.com>
Merge pull request #198 from mrjavadseydi/fix/issue-79-list-multipart-uploads
2026-10-01 07:15:59 +03:00 · 2026-09-16 15:27:48 +08:00 · 2026-09-16 13:40:10 +08:00 · 2026-09-16 13:24:52 +08:00 · 2026-09-16 13:16:37 +08:00 · 2026-09-16 12:51:20 +08:00
204 changed files with 14620 additions and 357 deletions
@@ -90,6 +90,12 @@ jobs:
      - name: Run S3 Select tests under race detector
        run: go test -race ./internal/s3select/... -count=1

+      - name: Run conditional PUT tests under race detector
+        run: go test -race ./cmd -run '^Test(PoolsConditionalPut|SinglePoolConditionalPutHTTP)' -count=1 -timeout=5m
+
+      - name: Run multipart listing and cancellation tests under race detector
+        run: go test -race ./cmd -run '^Test(MultipartListing|MultipartAbort|PaginateMultipartUploads|ListMultipartUploads)' -count=1 -timeout=5m
+
  crosscompile:
    name: Cross Compile
    runs-on: ubuntu-latest
@@ -0,0 +1,100 @@
+name: Repository Cards
+
+on:
+  schedule:
+    # 00:00 UTC = 08:00 Asia/Shanghai. GitHub may queue scheduled runs.
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/repository-cards.yml
+      - .github/silo.svg
+      - buildscripts/repository-cards/**
+  pull_request:
+    branches: [main]
+    paths:
+      - .github/workflows/repository-cards.yml
+      - .github/silo.svg
+      - buildscripts/repository-cards/**
+
+permissions:
+  contents: read
+
+concurrency:
+  group: repository-cards-${{ github.event.pull_request.number || 'publish' }}
+  cancel-in-progress: false
+
+jobs:
+  check:
+    name: Validate repository cards
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.13"
+      - run: python -m pip install -r buildscripts/repository-cards/requirements.txt
+      - run: python -m unittest discover -s buildscripts/repository-cards -p 'test_*.py' -v
+
+  publish:
+    name: Update README images
+    needs: check
+    if: github.repository == 'pgsty/silo' && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write
+      issues: read
+      pull-requests: read
+    env:
+      OUTPUT_BRANCH: codex/repository-cards
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.13"
+      - run: python -m pip install -r buildscripts/repository-cards/requirements.txt
+
+      - name: Load the generated-assets branch
+        shell: bash
+        run: |
+          set -euo pipefail
+          artifacts="$RUNNER_TEMP/repository-cards"
+          if git ls-remote --exit-code --heads origin "$OUTPUT_BRANCH"; then
+            git fetch --depth=1 origin "$OUTPUT_BRANCH"
+            git worktree add --detach "$artifacts" FETCH_HEAD
+          else
+            status=$?
+            # Exit 2 means no matching ref; transport/auth failures must stop.
+            if [ "$status" -ne 2 ]; then exit "$status"; fi
+            git worktree add --detach "$artifacts" HEAD
+            git -C "$artifacts" checkout --orphan "$OUTPUT_BRANCH"
+            git -C "$artifacts" rm -rf .
+          fi
+
+      - name: Refresh contributor and star cards
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: python buildscripts/repository-cards/update.py --output "$RUNNER_TEMP/repository-cards"
+
+      - name: Publish changed assets
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd "$RUNNER_TEMP/repository-cards"
+          git add README.md history.json curated.json contributors.json \
+            contributors-light.svg contributors-dark.svg \
+            star-history-light.svg star-history-dark.svg
+          if git diff --cached --quiet; then
+            echo "Repository cards are already current."
+            exit 0
+          fi
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git commit -s -m "chore: update repository cards $(date -u +%F)"
+          # A normal push preserves history and refuses concurrent overwrites.
+          git push origin "HEAD:refs/heads/$OUTPUT_BRANCH"
@@ -9,6 +9,33 @@ and [complete commit range](https://github.com/pgsty/silo/compare/RELEASE.2026-0

 ### Authorization and security

+- Restrict embedded Console's anonymous sharing proxy to object-content GETs
+  at the configured S3 origin, and reject every redirect. Internal metrics,
+  system paths and non-download S3 operations cannot be reached through it.
+  Normal public, presigned and versioned downloads remain available without a
+  new setting; a full sharing-disable switch is not introduced. See
+  [Console #56](https://github.com/pgsty/silo-console/pull/56) and the
+  [design record](https://github.com/pgsty/silo-console/issues/52).
+  Thanks to Jiri Pejchal (@jiri-pejchal) for the report.
+- Persist IAM deletion revisions and parent revocation boundaries so stale site
+  events cannot restore deleted identities, policies or their older grants
+  (#191, #192). Peer deletion notifications reload committed storage; deliberate
+  recreation requires a newer revision, and credentials issued before the
+  parent's revocation remain invalid.
+  **Coordinated upgrade required:** upgrade every participating node and site.
+  Mixed old/new nodes sharing an IAM backend and rolling downgrade are
+  unsupported. Back up complete IAM storage and encryption material; an admin
+  export of live records omits deletion history. Reissue credentials for
+  recreated parents and explicitly reconcile pre-upgrade revocations whose
+  history is already lost. Restoring an older backup can lose later revocations;
+  keep affected sites isolated until reconciliation/rekeying is complete. See
+  [the operator runbook](https://github.com/pgsty/silo.pgsty.com/blob/29c7f220b3acc556ad570694056d35e11246f1b9/content/operations/replication/iam-upgrade.md).
+- Enforce an absolute HTTP/1 request-header deadline through the connection
+  wrapper (#196). Repeated small reads no longer extend that deadline, and
+  `--read-header-timeout` / `MINIO_READ_HEADER_TIMEOUT` now reaches the HTTP
+  server. HTTP/1 request bodies retain the rolling idle timeout; this does not
+  impose a total upload/download duration. A shorter setting also constrains
+  TLS handshake reads. The wrapper's strict header mode is not applied to HTTP/2.
 - Reject unsigned `x-amz-*` request headers that could turn a signed PUT into a
  copy of another object accessible to the signer (SN-2026-011). The latest
  public Server is affected; the fix is on main. See [the advisory ledger](docs/security/advisories.md).
@@ -22,16 +49,64 @@ and [complete commit range](https://github.com/pgsty/silo/compare/RELEASE.2026-0

 ### Object storage and replication

+- Make `ListMultipartUploads` discover quorum-valid uploads from durable state
+  across pools, erasure sets and drives, then apply S3 prefix, delimiter,
+  marker, ordering and 1,000-entry pagination semantics globally (#198). New uploads
+  store their canonical bucket and key as reserved fields in the existing
+  quorum-written `xl.meta`; completion removes those upload-only fields. Native
+  markers remain usable after their upload is completed or canceled. Strict
+  listing returns a diagnostic 503 for legacy uploads or uncertain coverage;
+  `api multipart_listing=legacy` is an explicit temporary migration mode.
+  Upgrade every writer, drain old uploads and check the read-only admin
+  `multipart-preflight` report before relying on strict listing. Per-process
+  admission, directory-entry, worker and time budgets bound scan scheduling;
+  each page still scans durable state. See [issue #79](https://github.com/pgsty/silo/issues/79)
+  and its [design record](https://silo.pgsty.com/blog/design/list-multipart-uploads/).
+  Thanks to mr javad seydi (@mrjavadseydi) for the original implementation.
+- Confirm multipart cancellation on a strict majority of each relevant set,
+  and allow retries after partial deletion. Uncertain pools or insufficient
+  confirmations return 503 rather than acknowledging a cancellation whose
+  static remnants can later become readable. **Known boundary:** creation
+  writes that finish after a storage timeout can still restore an upload after
+  successful cancellation; this change does not add a durable creation fence.
+- Preserve object tags during multi-pool metadata reconciliation by reading the
+  resolved tag field together with its revision (#189). Previously, reconciliation
+  could replace existing tags with an empty value.
+- Preserve the tag revision on SSE-KMS metadata replication (#193), and advance
+  tag revisions monotonically on local PUT/DELETE tagging (#196). Empty tags
+  participate in reconciliation as an ordered deletion, preventing older
+  events from restoring removed tags. SSE-C key rotation also retains the tag
+  revision. Malformed historical revisions can fail and retry; their missing
+  history is not reconstructed by the upgrade.
+- Complete delete-marker version purges and preserve their identity and retry
+  state through MRF recovery (#196). Recovery accepts a 405 marker response only
+  when its version, bucket, object name and modification time match the task.
+  Purge audit status is normalized from `COMPLETE` to `COMPLETED`.
+  Thanks to Julien Laurenceau (@julienlau) for the investigation and proposed
+  fix in #184 that helped shape this follow-up.
+- Restore only the six replication-specific metadata fields after ordinary
+  request metadata extraction (#194). This prevents transport-only `aws-chunked`
+  from being stored as Content-Encoding while preserving the signed-header
+  protections. Trusted Snowball entries no longer inherit the outer archive's
+  ordinary metadata. Thanks to Mikhail Khadarenka (@chodorenko) for the fix in #187.
+  **Existing data:** these repairs prevent new errors; they do not scan or rewrite
+  historical object metadata, recover lost tags or prove that old purge work has
+  converged. Follow the [read-only audit procedure](https://github.com/pgsty/silo.pgsty.com/blob/29c7f220b3acc556ad570694056d35e11246f1b9/content/operations/replication/replica-metadata-audit.md)
+  before planning any repair of stored state.
+
 - Evaluate conditional multipart completion against the logical current object
  across all pools while holding the existing object lock. A stale `If-Match`
  can no longer replace newer data in another pool, and the current ETag is no
  longer rejected because the upload resides next to an older copy. Conditions
  are evaluated once; a current delete marker counts as an absent object.
-  **Availability change:** if metadata cannot be read from any pool, conditional
+  **Availability change:** if any pool's metadata cannot be read, conditional
  completion fails even when another pool can still serve GET/HEAD. This also
  applies when the unreadable pool may not hold the object: absence cannot be
  verified. Retry after the pool recovers. Unconditional completion and the
  single-pool path retain their existing behavior.
+  Ordinary conditional PUT has a separate cross-pool precondition gap tracked
+  in [#199](https://github.com/pgsty/silo/issues/199); the multipart repair does
+  not resolve it.

 - Reconcile ordinary single-object version DELETE across all pools, including
  null versions, delete markers and unqualified directory-marker DELETE. This
@@ -61,7 +136,7 @@ and [complete commit range](https://github.com/pgsty/silo/compare/RELEASE.2026-0
 - Repair federated CopyObject checksums, destination timestamps, reserved
  metadata, encrypted-object forwarding, legal hold and KMS context.
 - Make resync counters, target selection, cancellation and worker lifetimes
-  reflect actual work; complete delete-marker purges and report bounded MRF drops.
+  reflect actual work, and report bounded MRF drops.
 - Converge bucket metadata with deterministic source state, deletion tombstones,
  creation time recovery and diagnostics. The mixed-version export gate requires
  coordinated upgrades before tombstones are exported. See [the #77 record](docs/investigations/issue-77-current.md).
@@ -73,7 +148,7 @@ and [complete commit range](https://github.com/pgsty/silo/compare/RELEASE.2026-0
 - Restore embedded Console login over loopback TLS, trusted-proxy handling and
  all four WebSocket connection limits. Preserve Go TLS defaults across transports.
 - Directly require `github.com/pgsty/silo-pkg/v3` v3.14.0; select Console
-  `v0.0.0-20260913015128-417559bb2c97` and MC
+  `v0.0.0-20260916034812-56dfe455ac2f` and MC
  `v0.0.0-20260913012246-4f609a4da3bb` with explicit PGSTY replacements.
 - Pin upstream minio-go `v7.3.1-0.20260910142817-60bd07042d49`; refresh Go x/*
  modules and security fixes including bounded AMQP frame handling. Keep Go
@@ -1,8 +1,9 @@
 # Contributors

-SILO is built by **41 community contributors**, including its maintainers. This record covers every
+SILO is built by **42 community contributors**, including its maintainers. This record covers every
 human author who has opened an issue or pull request in the repositories listed below, in any state.
-It was checked against the complete, paginated GitHub API records on **2026-09-07 03:00:14 UTC**.
+The full API audit below dates to **2026-09-07 03:00:14 UTC**; later individually verified
+reports include Jiri Pejchal’s Console #52, added on **2026-09-16**.

 Contributors appear once in the avatar wall: authors of merged PRs first, other PR authors next,
 and issue-only authors after them. Within each group, substantial features, security and correctness
@@ -31,6 +32,7 @@ the Git history and [NOTICE](NOTICE); this record covers activity in the PGSTY r
 <a href="https://github.com/cbornet"><img src="https://silo.pgsty.com/images/contributors/cbornet.svg" width="60" height="60" alt="@cbornet" title="@cbornet — Reported multipart and streaming checksum defects and missing-bucket semantics"></a>
 <a href="https://github.com/vampywiz17"><img src="https://silo.pgsty.com/images/contributors/vampywiz17.svg" width="60" height="60" alt="@vampywiz17" title="@vampywiz17 — Reported LDAP TLS and Console login regressions"></a>
 <a href="https://github.com/orenyomtov"><img src="https://silo.pgsty.com/images/contributors/orenyomtov.svg" width="60" height="60" alt="@orenyomtov" title="@orenyomtov — Reported the unsigned-header CopyObject cross-object read (SN-2026-011)"></a>
+<a href="https://github.com/jiri-pejchal"><img src="https://silo.pgsty.com/images/contributors/jiri-pejchal.svg" width="60" height="60" alt="@jiri-pejchal" title="@jiri-pejchal — Reported the Console share proxy exposure of internal metrics"></a>
 <a href="https://github.com/mumu-lab"><img src="https://silo.pgsty.com/images/contributors/mumu-lab.svg" width="48" height="48" alt="@mumu-lab" title="@mumu-lab — Reported bucket quota metrics reading a deprecated field"></a>
 <a href="https://github.com/jvasile"><img src="https://silo.pgsty.com/images/contributors/jvasile.svg" width="48" height="48" alt="@jvasile" title="@jvasile — Reported missing user, group, and defaults in Debian packages"></a>
 <a href="https://github.com/pmezhuev"><img src="https://silo.pgsty.com/images/contributors/pmezhuev.svg" width="48" height="48" alt="@pmezhuev" title="@pmezhuev — Reported missing RPM package signatures"></a>
@@ -98,6 +100,7 @@ for their reports as well; the avatar wall and community total still count each
 | [@cbornet](https://github.com/cbornet) | [pgsty/silo#31](https://github.com/pgsty/silo/issues/31) Multipart uploads with FULL_OBJECT CRC32 not working<br>[pgsty/silo#32](https://github.com/pgsty/silo/issues/32) `listObjects` should return `NoSuchBucket` when the bucket doesn't exist and prefix is passed<br>[pgsty/silo#107](https://github.com/pgsty/silo/issues/107) PutObject fails with chunked encoding and checksumType |
 | [@vampywiz17](https://github.com/vampywiz17) | [pgsty/silo#15](https://github.com/pgsty/silo/issues/15) LDAP TLS regression in RELEASE.2026-03-21T00-00-00Z breaks built-in Console and external Console LDAP login on Kubernetes Tenant<br>[pgsty/silo#108](https://github.com/pgsty/silo/issues/108) Web Console login regression in RELEASE.2026-09-03T13-18-01Z (local and LDAP users fail) |
 | [@orenyomtov](https://github.com/orenyomtov) | Private security disclosure: a presigned or signed PUT could be turned into a server-side CopyObject read of any object the signing key can reach via an unsigned `x-amz-copy-source` header. Fixed as [`SN-2026-011`](https://github.com/pgsty/silo/blob/main/docs/security/advisories.md) ([pgsty/silo#173](https://github.com/pgsty/silo/pull/173)) |
+| [Jiri Pejchal (@jiri-pejchal)](https://github.com/jiri-pejchal) | [pgsty/silo-console#52](https://github.com/pgsty/silo-console/issues/52) — Reported anonymous access to internal metrics through the public object-sharing proxy, distinguished the demonstrated impact from hypothetical redirect abuse, and proposed server-side controls |
 | [@mumu-lab](https://github.com/mumu-lab) | [pgsty/silo#106](https://github.com/pgsty/silo/issues/106) 监控指标读取已弃用的 BucketQuota.Quota 字段导致 Quota 指标无值 |
 | [@jvasile](https://github.com/jvasile) | [pgsty/silo#33](https://github.com/pgsty/silo/issues/33) .deb doesn't create user/group/default files |
 | [@pmezhuev](https://github.com/pmezhuev) | [pgsty/silo#43](https://github.com/pgsty/silo/issues/43) RPM package for RELEASE.2026-06-18T00-00-00Z is missing GPG signature |
@@ -125,7 +128,8 @@ for their reports as well; the avatar wall and community total still count each
 ## Audit scope

 All issue and PR pages were read without a date cutoff. Counts below include automated accounts;
-the **40-person** roll excludes the two bots, Copilot and dependabot. The maintained product stack
+the historical **40-person** audit excluded the two bots, Copilot and dependabot.
+The current 42-person list also includes subsequent verified reports. The maintained product stack
 is SILO, Console, mcli, and silo-pkg; the SDK, KES, website, and older documentation repository were
 also checked for community submissions.

@@ -123,53 +123,25 @@ Report vulnerabilities privately as described in [`SECURITY.md`](SECURITY.md); e

 ## Contributors

-**41 community contributors** build SILO, Console, mcli, shared packages, and related projects. The list includes maintainers and every human Issue or PR author, ordered by merged PRs, other PRs, then issue reports. Gold rings highlight significant contributions.
+<!-- Generated by silo.pgsty.com/bin/contributors.py. -->

-<p align="center">
-<a href="https://github.com/Vonng"><img src="https://silo.pgsty.com/images/contributors/Vonng.svg" width="60" height="60" alt="@Vonng" title="@Vonng — Maintains SILO, Console, mcli, shared packages, releases, and documentation"></a>
-<a href="https://github.com/h5vx"><img src="https://silo.pgsty.com/images/contributors/h5vx.svg" width="60" height="60" alt="@h5vx" title="@h5vx — Implemented per-bucket CORS configuration and enforcement"></a>
-<a href="https://github.com/mrjavadseydi"><img src="https://silo.pgsty.com/images/contributors/mrjavadseydi.svg" width="60" height="60" alt="@mrjavadseydi" title="@mrjavadseydi — Fixed effective bucket quota metrics; proposed access-frequency ILM"></a>
-<a href="https://github.com/Dansyuqri"><img src="https://silo.pgsty.com/images/contributors/Dansyuqri.svg" width="60" height="60" alt="@Dansyuqri" title="@Dansyuqri — Added ChecksumType to multipart completion responses"></a>
-<a href="https://github.com/ycjlin"><img src="https://silo.pgsty.com/images/contributors/ycjlin.svg" width="60" height="60" alt="@ycjlin" title="@ycjlin — Fixed missing-bucket ListObjects semantics"></a>
-<a href="https://github.com/pinginfo"><img src="https://silo.pgsty.com/images/contributors/pinginfo.svg" width="60" height="60" alt="@pinginfo" title="@pinginfo — Repaired bucket notification streaming"></a>
-<a href="https://github.com/ZouhairCharef"><img src="https://silo.pgsty.com/images/contributors/ZouhairCharef.svg" width="60" height="60" alt="@ZouhairCharef" title="@ZouhairCharef — Patched CVE-2026-34986 in go-jose"></a>
-<a href="https://github.com/mfredenhagen"><img src="https://silo.pgsty.com/images/contributors/mfredenhagen.svg" width="60" height="60" alt="@mfredenhagen" title="@mfredenhagen — Patched CVE-2026-39883 in OpenTelemetry"></a>
-<a href="https://github.com/waterkip"><img src="https://silo.pgsty.com/images/contributors/waterkip.svg" width="60" height="60" alt="@waterkip" title="@waterkip — Repointed documentation links to the SILO portal"></a>
-<a href="https://github.com/mikemikimike"><img src="https://silo.pgsty.com/images/contributors/mikemikimike.svg" width="60" height="60" alt="@mikemikimike" title="@mikemikimike — Contributed the replicated SSE-C plaintext part-size fix"></a>
-<a href="https://github.com/metaneutrons"><img src="https://silo.pgsty.com/images/contributors/metaneutrons.svg" width="60" height="60" alt="@metaneutrons" title="@metaneutrons — Reported and proposed explicit-version delete authorization"></a>
-<a href="https://github.com/magicxor"><img src="https://silo.pgsty.com/images/contributors/magicxor.svg" width="60" height="60" alt="@magicxor" title="@magicxor — Reported and proposed conditional DELETE support for If-Match"></a>
-<a href="https://github.com/davinkevin"><img src="https://silo.pgsty.com/images/contributors/davinkevin.svg" width="60" height="60" alt="@davinkevin" title="@davinkevin — Proposed the distroless container image and dependency automation"></a>
-<a href="https://github.com/lem21h"><img src="https://silo.pgsty.com/images/contributors/lem21h.svg" width="48" height="48" alt="@lem21h" title="@lem21h — Proposed robustness and goroutine improvements"></a>
-<a href="https://github.com/sulin37392"><img src="https://silo.pgsty.com/images/contributors/sulin37392.svg" width="48" height="48" alt="@sulin37392" title="@sulin37392 — Proposed dependency updates"></a>
-<a href="https://github.com/cbornet"><img src="https://silo.pgsty.com/images/contributors/cbornet.svg" width="60" height="60" alt="@cbornet" title="@cbornet — Reported multipart and streaming checksum defects and missing-bucket semantics"></a>
-<a href="https://github.com/vampywiz17"><img src="https://silo.pgsty.com/images/contributors/vampywiz17.svg" width="60" height="60" alt="@vampywiz17" title="@vampywiz17 — Reported LDAP TLS and Console login regressions"></a>
-<a href="https://github.com/orenyomtov"><img src="https://silo.pgsty.com/images/contributors/orenyomtov.svg" width="60" height="60" alt="@orenyomtov" title="@orenyomtov — Reported the unsigned-header CopyObject cross-object read (SN-2026-011)"></a>
-<a href="https://github.com/mumu-lab"><img src="https://silo.pgsty.com/images/contributors/mumu-lab.svg" width="48" height="48" alt="@mumu-lab" title="@mumu-lab — Reported bucket quota metrics reading a deprecated field"></a>
-<a href="https://github.com/jvasile"><img src="https://silo.pgsty.com/images/contributors/jvasile.svg" width="48" height="48" alt="@jvasile" title="@jvasile — Reported missing user, group, and defaults in Debian packages"></a>
-<a href="https://github.com/pmezhuev"><img src="https://silo.pgsty.com/images/contributors/pmezhuev.svg" width="48" height="48" alt="@pmezhuev" title="@pmezhuev — Reported missing RPM package signatures"></a>
-<a href="https://github.com/TLINDEN"><img src="https://silo.pgsty.com/images/contributors/TLINDEN.svg" width="48" height="48" alt="@TLINDEN" title="@TLINDEN — Reported the missing client in release tarballs"></a>
-<a href="https://github.com/makinikm"><img src="https://silo.pgsty.com/images/contributors/makinikm.svg" width="48" height="48" alt="@makinikm" title="@makinikm — Reported the missing client in the container image"></a>
-<a href="https://github.com/meesudzu"><img src="https://silo.pgsty.com/images/contributors/meesudzu.svg" width="48" height="48" alt="@meesudzu" title="@meesudzu — Requested the migration guide from upstream MinIO"></a>
-<a href="https://github.com/kuldeep-link11"><img src="https://silo.pgsty.com/images/contributors/kuldeep-link11.svg" width="48" height="48" alt="@kuldeep-link11" title="@kuldeep-link11 — Reported NATS JWT credentials and target reload issues"></a>
-<a href="https://github.com/sargarass"><img src="https://silo.pgsty.com/images/contributors/sargarass.svg" width="48" height="48" alt="@sargarass" title="@sargarass — Reported ListMultipartUploads prefix and pagination semantics"></a>
-<a href="https://github.com/liuhaodongliu990-cmyk"><img src="https://silo.pgsty.com/images/contributors/liuhaodongliu990-cmyk.svg" width="48" height="48" alt="@liuhaodongliu990-cmyk" title="@liuhaodongliu990-cmyk — Reported indeterminate progress for prefix downloads"></a>
-<a href="https://github.com/Xavier-777"><img src="https://silo.pgsty.com/images/contributors/Xavier-777.svg" width="48" height="48" alt="@Xavier-777" title="@Xavier-777 — Reported Console lifecycle management and file preview gaps"></a>
-<a href="https://github.com/spaceg00se-r"><img src="https://silo.pgsty.com/images/contributors/spaceg00se-r.svg" width="48" height="48" alt="@spaceg00se-r" title="@spaceg00se-r — Requested cpuv1 support and reported a workflow token failure"></a>
-<a href="https://github.com/kh0mka"><img src="https://silo.pgsty.com/images/contributors/kh0mka.svg" width="48" height="48" alt="@kh0mka" title="@kh0mka — Reported inter-node I/O timeouts in ReadFileStreamHandler"></a>
-<a href="https://github.com/bagutzu"><img src="https://silo.pgsty.com/images/contributors/bagutzu.svg" width="48" height="48" alt="@bagutzu" title="@bagutzu — Requested KES-compatible external KMS and OpenBao support"></a>
-<a href="https://github.com/DestroyLee"><img src="https://silo.pgsty.com/images/contributors/DestroyLee.svg" width="48" height="48" alt="@DestroyLee" title="@DestroyLee — Reported the missing documentation navigation"></a>
-<a href="https://github.com/mosesdd"><img src="https://silo.pgsty.com/images/contributors/mosesdd.svg" width="48" height="48" alt="@mosesdd" title="@mosesdd — Requested a maintained Helm chart"></a>
-<a href="https://github.com/zylpsrs"><img src="https://silo.pgsty.com/images/contributors/zylpsrs.svg" width="48" height="48" alt="@zylpsrs" title="@zylpsrs — Reported missing Console tiering and site replication"></a>
-<a href="https://github.com/heroes1412"><img src="https://silo.pgsty.com/images/contributors/heroes1412.svg" width="48" height="48" alt="@heroes1412" title="@heroes1412 — Reported the unusable profiling option"></a>
-<a href="https://github.com/redfoxfox"><img src="https://silo.pgsty.com/images/contributors/redfoxfox.svg" width="48" height="48" alt="@redfoxfox" title="@redfoxfox — Reported Chinese documentation availability"></a>
-<a href="https://github.com/jiadzh"><img src="https://silo.pgsty.com/images/contributors/jiadzh.svg" width="48" height="48" alt="@jiadzh" title="@jiadzh — Requested Windows build guidance"></a>
-<a href="https://github.com/AntonOfTheWoods"><img src="https://silo.pgsty.com/images/contributors/AntonOfTheWoods.svg" width="48" height="48" alt="@AntonOfTheWoods" title="@AntonOfTheWoods — Asked for clarity on Helm chart and operator options"></a>
-<a href="https://github.com/chalukyaj"><img src="https://silo.pgsty.com/images/contributors/chalukyaj.svg" width="48" height="48" alt="@chalukyaj" title="@chalukyaj — Proposed making the SILO Operator easier to discover"></a>
-<a href="https://github.com/nsanitate"><img src="https://silo.pgsty.com/images/contributors/nsanitate.svg" width="48" height="48" alt="@nsanitate" title="@nsanitate — Proposed CNCF Sandbox governance"></a>
-<a href="https://github.com/Kesavaambati"><img src="https://silo.pgsty.com/images/contributors/Kesavaambati.svg" width="48" height="48" alt="@Kesavaambati" title="@Kesavaambati — Asked about community support and image maintenance"></a>
-</p>
+Every human issue or pull-request author is part of the SILO community, including open and unmerged work. Merged fixes, adopted proposals, and actionable reports receive priority, with first participation guiding the remaining order. Gold rings highlight reviewed significant contributions.

-[View the full contribution record](CONTRIBUTORS.md) for each person's proposals, fixes, and reports.
+<a href="CONTRIBUTORS.md">
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/pgsty/silo/codex/repository-cards/contributors-dark.svg">
+  <img src="https://raw.githubusercontent.com/pgsty/silo/codex/repository-cards/contributors-light.svg" alt="SILO community contributors">
+</picture>
+</a>
+
+[View contribution notes and actual PR status](CONTRIBUTORS.md).
+
+## Star History
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/pgsty/silo/codex/repository-cards/star-history-dark.svg">
+  <img src="https://raw.githubusercontent.com/pgsty/silo/codex/repository-cards/star-history-light.svg" alt="SILO GitHub star history">
+</picture>

 ## Background

@@ -102,53 +102,25 @@ S3 API、`MINIO_*` 环境变量、`minio_*` 指标、`x-minio-*` 头、`/minio/*

 ## 贡献者

-**41 位社区贡献者**共同建设 SILO、Console、mcli、公共包与相关项目。名单包含维护者，以及所有提出 Issue 或 PR 的真人作者；按已合并 PR、其他 PR、Issue 报告排序，黄圈标记显著贡献。
+<!-- Generated by silo.pgsty.com/bin/contributors.py. -->

-<p align="center">
-<a href="https://github.com/Vonng"><img src="https://silo.pgsty.com/images/contributors/Vonng.svg" width="60" height="60" alt="@Vonng" title="@Vonng — 维护 SILO、Console、mcli、公共包、发行与文档"></a>
-<a href="https://github.com/h5vx"><img src="https://silo.pgsty.com/images/contributors/h5vx.svg" width="60" height="60" alt="@h5vx" title="@h5vx — 实现单桶 CORS 配置与请求执行"></a>
-<a href="https://github.com/mrjavadseydi"><img src="https://silo.pgsty.com/images/contributors/mrjavadseydi.svg" width="60" height="60" alt="@mrjavadseydi" title="@mrjavadseydi — 修复有效桶配额指标，并提交按访问频率分层的 ILM 方案"></a>
-<a href="https://github.com/Dansyuqri"><img src="https://silo.pgsty.com/images/contributors/Dansyuqri.svg" width="60" height="60" alt="@Dansyuqri" title="@Dansyuqri — 为分片上传完成响应补充 ChecksumType"></a>
-<a href="https://github.com/ycjlin"><img src="https://silo.pgsty.com/images/contributors/ycjlin.svg" width="60" height="60" alt="@ycjlin" title="@ycjlin — 修复缺失桶的 ListObjects 语义"></a>
-<a href="https://github.com/pinginfo"><img src="https://silo.pgsty.com/images/contributors/pinginfo.svg" width="60" height="60" alt="@pinginfo" title="@pinginfo — 修复桶通知的流式输出"></a>
-<a href="https://github.com/ZouhairCharef"><img src="https://silo.pgsty.com/images/contributors/ZouhairCharef.svg" width="60" height="60" alt="@ZouhairCharef" title="@ZouhairCharef — 修复 go-jose 中的 CVE-2026-34986"></a>
-<a href="https://github.com/mfredenhagen"><img src="https://silo.pgsty.com/images/contributors/mfredenhagen.svg" width="60" height="60" alt="@mfredenhagen" title="@mfredenhagen — 修复 OpenTelemetry 中的 CVE-2026-39883"></a>
-<a href="https://github.com/waterkip"><img src="https://silo.pgsty.com/images/contributors/waterkip.svg" width="60" height="60" alt="@waterkip" title="@waterkip — 将文档链接指向 SILO 门户"></a>
-<a href="https://github.com/mikemikimike"><img src="https://silo.pgsty.com/images/contributors/mikemikimike.svg" width="60" height="60" alt="@mikemikimike" title="@mikemikimike — 提交 SSE-C 复制分片明文尺寸修复"></a>
-<a href="https://github.com/metaneutrons"><img src="https://silo.pgsty.com/images/contributors/metaneutrons.svg" width="60" height="60" alt="@metaneutrons" title="@metaneutrons — 报告并提交显式版本删除鉴权方案"></a>
-<a href="https://github.com/magicxor"><img src="https://silo.pgsty.com/images/contributors/magicxor.svg" width="60" height="60" alt="@magicxor" title="@magicxor — 报告并提交 DELETE If-Match 条件请求支持方案"></a>
-<a href="https://github.com/davinkevin"><img src="https://silo.pgsty.com/images/contributors/davinkevin.svg" width="60" height="60" alt="@davinkevin" title="@davinkevin — 提交 distroless 容器镜像与依赖自动更新方案"></a>
-<a href="https://github.com/lem21h"><img src="https://silo.pgsty.com/images/contributors/lem21h.svg" width="48" height="48" alt="@lem21h" title="@lem21h — 提交健壮性与 goroutine 改进"></a>
-<a href="https://github.com/sulin37392"><img src="https://silo.pgsty.com/images/contributors/sulin37392.svg" width="48" height="48" alt="@sulin37392" title="@sulin37392 — 提交依赖更新"></a>
-<a href="https://github.com/cbornet"><img src="https://silo.pgsty.com/images/contributors/cbornet.svg" width="60" height="60" alt="@cbornet" title="@cbornet — 报告分片与流式校验和缺陷及缺失桶语义问题"></a>
-<a href="https://github.com/vampywiz17"><img src="https://silo.pgsty.com/images/contributors/vampywiz17.svg" width="60" height="60" alt="@vampywiz17" title="@vampywiz17 — 报告 LDAP TLS 与 Console 登录回归"></a>
-<a href="https://github.com/orenyomtov"><img src="https://silo.pgsty.com/images/contributors/orenyomtov.svg" width="60" height="60" alt="@orenyomtov" title="@orenyomtov — 报告未签名头导致的 CopyObject 跨对象读取（SN-2026-011）"></a>
-<a href="https://github.com/mumu-lab"><img src="https://silo.pgsty.com/images/contributors/mumu-lab.svg" width="48" height="48" alt="@mumu-lab" title="@mumu-lab — 报告桶配额指标读取已弃用字段的问题"></a>
-<a href="https://github.com/jvasile"><img src="https://silo.pgsty.com/images/contributors/jvasile.svg" width="48" height="48" alt="@jvasile" title="@jvasile — 报告 Debian 包缺少用户、用户组与默认配置"></a>
-<a href="https://github.com/pmezhuev"><img src="https://silo.pgsty.com/images/contributors/pmezhuev.svg" width="48" height="48" alt="@pmezhuev" title="@pmezhuev — 报告 RPM 包缺少 GPG 签名"></a>
-<a href="https://github.com/TLINDEN"><img src="https://silo.pgsty.com/images/contributors/TLINDEN.svg" width="48" height="48" alt="@TLINDEN" title="@TLINDEN — 报告发布压缩包缺少客户端"></a>
-<a href="https://github.com/makinikm"><img src="https://silo.pgsty.com/images/contributors/makinikm.svg" width="48" height="48" alt="@makinikm" title="@makinikm — 报告容器镜像缺少客户端"></a>
-<a href="https://github.com/meesudzu"><img src="https://silo.pgsty.com/images/contributors/meesudzu.svg" width="48" height="48" alt="@meesudzu" title="@meesudzu — 提出从上游 MinIO 迁移的指南需求"></a>
-<a href="https://github.com/kuldeep-link11"><img src="https://silo.pgsty.com/images/contributors/kuldeep-link11.svg" width="48" height="48" alt="@kuldeep-link11" title="@kuldeep-link11 — 报告 NATS JWT 凭据与通知目标重载问题"></a>
-<a href="https://github.com/sargarass"><img src="https://silo.pgsty.com/images/contributors/sargarass.svg" width="48" height="48" alt="@sargarass" title="@sargarass — 报告 ListMultipartUploads 前缀与分页语义问题"></a>
-<a href="https://github.com/liuhaodongliu990-cmyk"><img src="https://silo.pgsty.com/images/contributors/liuhaodongliu990-cmyk.svg" width="48" height="48" alt="@liuhaodongliu990-cmyk" title="@liuhaodongliu990-cmyk — 报告前缀下载进度显示异常"></a>
-<a href="https://github.com/Xavier-777"><img src="https://silo.pgsty.com/images/contributors/Xavier-777.svg" width="48" height="48" alt="@Xavier-777" title="@Xavier-777 — 报告 Console 生命周期管理与文件预览缺失"></a>
-<a href="https://github.com/spaceg00se-r"><img src="https://silo.pgsty.com/images/contributors/spaceg00se-r.svg" width="48" height="48" alt="@spaceg00se-r" title="@spaceg00se-r — 提出 cpuv1 支持需求并报告工作流令牌错误"></a>
-<a href="https://github.com/kh0mka"><img src="https://silo.pgsty.com/images/contributors/kh0mka.svg" width="48" height="48" alt="@kh0mka" title="@kh0mka — 报告 ReadFileStreamHandler 节点间 I/O 超时"></a>
-<a href="https://github.com/bagutzu"><img src="https://silo.pgsty.com/images/contributors/bagutzu.svg" width="48" height="48" alt="@bagutzu" title="@bagutzu — 提出兼容 KES 的外部 KMS 与 OpenBao 支持需求"></a>
-<a href="https://github.com/DestroyLee"><img src="https://silo.pgsty.com/images/contributors/DestroyLee.svg" width="48" height="48" alt="@DestroyLee" title="@DestroyLee — 报告文档目录导航缺失"></a>
-<a href="https://github.com/mosesdd"><img src="https://silo.pgsty.com/images/contributors/mosesdd.svg" width="48" height="48" alt="@mosesdd" title="@mosesdd — 提出维护 Helm Chart 的需求"></a>
-<a href="https://github.com/zylpsrs"><img src="https://silo.pgsty.com/images/contributors/zylpsrs.svg" width="48" height="48" alt="@zylpsrs" title="@zylpsrs — 报告 Console 缺少分层与站点复制"></a>
-<a href="https://github.com/heroes1412"><img src="https://silo.pgsty.com/images/contributors/heroes1412.svg" width="48" height="48" alt="@heroes1412" title="@heroes1412 — 报告性能分析选项不可用"></a>
-<a href="https://github.com/redfoxfox"><img src="https://silo.pgsty.com/images/contributors/redfoxfox.svg" width="48" height="48" alt="@redfoxfox" title="@redfoxfox — 报告中文文档站点不可用"></a>
-<a href="https://github.com/jiadzh"><img src="https://silo.pgsty.com/images/contributors/jiadzh.svg" width="48" height="48" alt="@jiadzh" title="@jiadzh — 提出 Windows 构建指导需求"></a>
-<a href="https://github.com/AntonOfTheWoods"><img src="https://silo.pgsty.com/images/contributors/AntonOfTheWoods.svg" width="48" height="48" alt="@AntonOfTheWoods" title="@AntonOfTheWoods — 提出明确 Helm Chart 与 Operator 选项的需求"></a>
-<a href="https://github.com/chalukyaj"><img src="https://silo.pgsty.com/images/contributors/chalukyaj.svg" width="48" height="48" alt="@chalukyaj" title="@chalukyaj — 提出改善 SILO Operator 可发现性的建议"></a>
-<a href="https://github.com/nsanitate"><img src="https://silo.pgsty.com/images/contributors/nsanitate.svg" width="48" height="48" alt="@nsanitate" title="@nsanitate — 提出加入 CNCF Sandbox 的治理建议"></a>
-<a href="https://github.com/Kesavaambati"><img src="https://silo.pgsty.com/images/contributors/Kesavaambati.svg" width="48" height="48" alt="@Kesavaambati" title="@Kesavaambati — 提出社区支持与容器镜像维护问题"></a>
-</p>
+每位 issue 或 PR 的作者都是 SILO 社区的一员，包括尚未合并的工作。已合并的修复、被采纳的方案和有效报告优先展示，其余参考首次参与时间；金色圆环突出经过审核的显著贡献。

-[查看完整贡献记录](CONTRIBUTORS.md)，了解每位贡献者的提案、修复与问题报告。
+<a href="CONTRIBUTORS.md">
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/pgsty/silo/codex/repository-cards/contributors-dark.svg">
+  <img src="https://raw.githubusercontent.com/pgsty/silo/codex/repository-cards/contributors-light.svg" alt="SILO 社区贡献者">
+</picture>
+</a>
+
+[查看贡献记录与实际 PR 状态](CONTRIBUTORS.md)。
+
+## Star History
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/pgsty/silo/codex/repository-cards/star-history-dark.svg">
+  <img src="https://raw.githubusercontent.com/pgsty/silo/codex/repository-cards/star-history-light.svg" alt="SILO GitHub 星标历史">
+</picture>

 ## 背景

@@ -134,6 +134,7 @@
    "MINIO_API_GZIP_OBJECTS",
    "MINIO_API_LEGACY_BUCKET_RESOURCE_MATCH",
    "MINIO_API_LIST_QUORUM",
+    "MINIO_API_MULTIPART_LISTING",
    "MINIO_API_OBJECT_MAX_VERSIONS",
    "MINIO_API_ODIRECT",
    "MINIO_API_REMOTE_TRANSPORT_DEADLINE",
@@ -766,6 +767,7 @@
    "/metrics/v3",
    "/minio/grid/",
    "/minio/grid/lock/",
+    "/multipart-preflight",
    "/netperf",
    "/notification",
    "/oauth2/callback",
@@ -934,6 +936,7 @@
    "arn:minio:kms:::this-is-disregarded",
    "arn:minio:kms:::xyz-test-key",
    "arn:minio:replication:",
+    "arn:minio:replication::",
    "arn:minio:replication::8320b6d18f9032b4700f1f03b50d8d1853de8f22cab86931ee794e12f190852c:destinationbucket",
    "arn:minio:replication:::",
    "arn:minio:replication:::dest-bucket",
@@ -0,0 +1 @@
+__pycache__/
@@ -0,0 +1,163 @@
+# Copyright (c) 2026 Feng Ruohang
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+"""Pure, self-contained SVG rendering for SILO's README cards."""
+from datetime import date, timedelta
+from html import escape
+import math
+import xml.etree.ElementTree as ET
+
+themes = {
+    'light': dict(bg='#ffffff', wash='#f2f7fc', edge='#d9e3ee', ink='#16222e',
+                  muted='#62758a', blue='#1d588c', copper='#b4762e', grid='#e5edf5',
+                  line='#2b6ca3', ring='#dce5ef', field='#f7f9fc', label='#3d4e61'),
+    'dark': dict(bg='#101923', wash='#152738', edge='#2b3c50', ink='#e8eef6',
+                 muted='#93a3b8', blue='#7fb8e8', copper='#e0a35c', grid='#263749',
+                 line='#5da2dd', ring='#3a4e63', field='#0b1119', label='#b6c2d2'),
+}
+
+def read_emblem(path):
+    emblem = ET.parse(path).getroot()
+    body = ''.join(ET.tostring(child, encoding='unicode') for child in emblem
+                   if child.tag.rsplit('}', 1)[-1] in ('defs', 'g'))
+    return '\n'.join(line.rstrip() for line in body.splitlines()).strip()
+
+
+def txt(x, y, value, size=14, color=None, weight=400, anchor='start', mono=False, spacing=None):
+    family = 'Menlo,Consolas,monospace' if mono else 'Arial,Helvetica,sans-serif'
+    extra = f' letter-spacing="{spacing}"' if spacing is not None else ''
+    return (f'<text x="{x}" y="{y}" font-family="{family}" font-size="{size}" '
+            f'font-weight="{weight}" fill="{color}" text-anchor="{anchor}"{extra}>'
+            f'{escape(str(value))}</text>')
+
+
+def start(height, theme, title, description, emblem_body):
+    t = themes[theme]
+    return [f'<svg xmlns="http://www.w3.org/2000/svg" width="1000" height="{height}" '
+            f'viewBox="0 0 1000 {height}" role="img" aria-labelledby="title desc">',
+            f'<title id="title">{escape(title)}</title><desc id="desc">{escape(description)}</desc>',
+            '<defs><linearGradient id="surface" x1="0" y1="1" x2="1" y2="0">'
+            f'<stop offset="0" stop-color="{t["bg"]}"/>'
+            f'<stop offset="1" stop-color="{t["wash"]}"/></linearGradient>'
+            '<linearGradient id="accent" x1="0" y1="0" x2="1" y2="0">'
+            f'<stop offset="0" stop-color="{t["blue"]}"/>'
+            f'<stop offset="1" stop-color="{t["copper"]}"/></linearGradient>'
+            '<linearGradient id="area" x1="0" y1="0" x2="0" y2="1">'
+            f'<stop offset="0" stop-color="{t["line"]}" stop-opacity=".22"/>'
+            f'<stop offset="1" stop-color="{t["line"]}" stop-opacity=".015"/>'
+            '</linearGradient></defs>',
+            f'<rect x=".75" y=".75" width="998.5" height="{height-1.5}" rx="22" '
+            f'fill="url(#surface)" stroke="{t["edge"]}" stroke-width="1.5"/>',
+            f'<svg x="40" y="25" width="25" height="25" viewBox="230 213 570 570">{emblem_body}</svg>']
+
+
+def heading(parts, t, eyebrow, title, subtitle, value, value_label):
+    parts.extend([
+        txt(76, 43, eyebrow, 11, t['muted'], 600, mono=True, spacing=1.7),
+        txt(40, 94, title, 32, t['ink'], 700),
+        txt(41, 123, subtitle, 14, t['muted']),
+        txt(958, 89, f'{value:,}', 45, t['ink'], 700, anchor='end'),
+        txt(957, 114, value_label, 10, t['muted'], 600, anchor='end', mono=True, spacing=1.5),
+        f'<path d="M40 146 H960" stroke="{t["edge"]}"/>',
+    ])
+
+
+def contributors(theme, people, snapshot, emblem_body):
+    height = 206 + 76 * math.ceil(len(people) / 10)
+    t = themes[theme]
+    parts = start(height, theme, f'SILO community — {len(people)} contributors',
+                  f'The existing SILO community roll, including code, proposals and reports across related projects. '
+                  f'Gold rings retain the existing significant-contribution designation. Snapshot {snapshot}.', emblem_body)
+    heading(parts, t, 'SILO / COMMUNITY', 'Contributors',
+            'Code, proposals & reports across SILO and related projects', len(people), 'COMMUNITY CONTRIBUTORS')
+    for row in range(math.ceil(len(people) / 10)):
+        group = people[row * 10:(row + 1) * 10]
+        row_width = len(group) * 91
+        for col, person in enumerate(group):
+            x = (1000 - row_width) / 2 + col * 91 + 45.5
+            y = 199 + row * 76
+            identifier = f'avatar-{row}-{col}'
+            featured = bool(person.get('featured'))
+            parts.append(f'<g><title>@{escape(person["handle"])} — {escape(person["what"])}</title>')
+            parts.append(f'<defs><clipPath id="{identifier}"><circle cx="{x}" cy="{y}" r="29"/></clipPath></defs>')
+            if featured:
+                parts.append(f'<circle cx="{x}" cy="{y}" r="34" fill="{t["copper"]}" opacity=".09"/>')
+            if person.get('avatarDataUrl'):
+                parts.append(f'<image x="{x-29}" y="{y-29}" width="58" height="58" '
+                             f'clip-path="url(#{identifier})" href="{escape(person["avatarDataUrl"])}"/>')
+            else:
+                parts.append(f'<circle cx="{x}" cy="{y}" r="29" fill="{t["ring"]}"/>')
+                parts.append(txt(x, y + 9, person['handle'][0].upper(), 26, t['ink'], 700, 'middle'))
+            parts.append(f'<circle cx="{x}" cy="{y}" r="30.5" fill="none" '
+                         f'stroke="{t["copper"] if featured else t["ring"]}" stroke-width="{2 if featured else 1.25}"/></g>')
+    parts.extend([
+        f'<path d="M40 {height-42} H960" stroke="{t["edge"]}"/>',
+        f'<circle cx="47" cy="{height-21}" r="4" fill="none" stroke="{t["copper"]}" stroke-width="1.5"/>',
+        txt(61, height-17, 'Gold rings mark significant contributions', 12, t['muted']),
+        txt(959, height-17, f'AS OF {snapshot}', 10, t['muted'], 500, 'end', mono=True, spacing=.6),
+        '</svg>',
+    ])
+    return ''.join(parts)
+
+
+def stars(theme, history, snapshot, emblem_body):
+    points = history['points']
+    star_count = points[-1]['stars']
+    t = themes[theme]
+    provenance = ('Initial history reconstructed · Daily totals since ' + history['bootstrap']['through'] + ' · UTC'
+                  if history['bootstrap']['reconstructed'] else 'Observed daily star totals · UTC')
+    parts = start(558, theme, f'SILO star history — {star_count:,} stars',
+                  f'GitHub repository pgsty/silo. {star_count:,} stars as of {snapshot}. ' +
+                  provenance, emblem_body)
+    heading(parts, t, 'SILO / GITHUB', 'Star History', 'pgsty/silo', star_count, 'GITHUB STARS')
+    left, right, top, bottom = 76, 958, 177, 440
+    begin = date.fromisoformat(points[0]['date'])
+    end = date.fromisoformat(points[-1]['date'])
+    days = max(1, (end - begin).days)
+    maximum = max(500, math.ceil(max(p['stars'] for p in points) / 500) * 500)
+    tick_step = 10 ** max(0, int(math.log10(maximum)))
+    xy = lambda day, n: (left + (right-left)*(date.fromisoformat(day)-begin).days / days,
+                         bottom-(bottom-top)*n/maximum)
+    for value in range(0, maximum+1, tick_step):
+        y = xy(points[0]['date'], value)[1]
+        parts.append(f'<path d="M{left} {y:.2f} H{right}" stroke="{t["grid"]}" stroke-dasharray="4 6"/>')
+        parts.append(txt(left-16, round(y+4, 2), f'{value / 1000:g}k' if value >= 1000 else str(value), 12, t['muted'], anchor='end'))
+    dates = sorted({begin + timedelta(days=round((end-begin).days*i/5)) for i in range(6)})
+    ticks = [(d.isoformat(), d.strftime('%b %Y') if days > 90 else d.strftime('%b %d')) for d in dates]
+    for day, label in ticks:
+        x = xy(day, 0)[0]
+        parts.append(f'<path d="M{x:.2f} {top} V{bottom}" stroke="{t["grid"]}" stroke-opacity=".65"/>')
+        anchor = 'start' if day == points[0]['date'] else 'end' if day == snapshot else 'middle'
+        parts.append(txt(round(x, 2), 466, label, 12, t['muted'], anchor=anchor))
+    coords = [xy(p['date'], p['stars']) for p in points]
+    line = 'M' + ' L'.join(f'{x:.2f} {y:.2f}' for x, y in coords)
+    area = line + f' L{coords[-1][0]:.2f} {bottom} L{left} {bottom} Z'
+    parts.extend([
+        f'<path d="{area}" fill="url(#area)"/>',
+        f'<path d="{line}" fill="none" stroke="url(#accent)" stroke-width="3" '
+        'stroke-linecap="round" stroke-linejoin="round"/>',
+        f'<path d="M{left} {bottom} H{right}" stroke="{t["edge"]}"/>',
+    ])
+    x, y = coords[-1]
+    parts.extend([
+        f'<circle cx="{x}" cy="{y}" r="10" fill="{t["copper"]}" opacity=".12"/>',
+        f'<circle cx="{x}" cy="{y}" r="5" fill="{t["copper"]}" stroke="{t["bg"]}" stroke-width="2"/>',
+        f'<path d="M40 491 H960" stroke="{t["edge"]}"/>',
+        txt(40, 516, f'{begin:%b %Y} — {end:%b %Y}'.upper(), 10, t['muted'], 500, mono=True, spacing=.7),
+        txt(959, 516, f'SNAPSHOT {snapshot}', 10, t['muted'], 500, 'end', mono=True, spacing=.6),
+        txt(40, 539, provenance, 11, t['muted']),
+        '</svg>',
+    ])
+    return ''.join(parts)
@@ -0,0 +1 @@
+PyYAML==6.0.3
@@ -0,0 +1,178 @@
+# Copyright (c) 2026 Feng Ruohang
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+"""Regression checks for historical accuracy, contributor scope and SVG safety."""
+
+import base64
+import json
+from pathlib import Path
+import tempfile
+import unittest
+from unittest.mock import patch
+from urllib.error import URLError
+import xml.etree.ElementTree as ET
+
+import render
+import update
+
+NS = {'s': 'http://www.w3.org/2000/svg'}
+PNG = base64.b64decode('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+a7mgAAAAASUVORK5CYII=')
+
+
+def person(handle='Alice', group='reports', featured=False):
+    return {'handle': handle, 'group': group, 'featured': featured,
+            'what': 'A reviewed contribution', 'firstContribution': '2026-09-01'}
+
+
+def history():
+    return {'repository': 'pgsty/silo',
+            'bootstrap': {'through': '2026-09-15', 'reconstructed': True},
+            'points': [{'date': '2026-09-14', 'stars': 100}, {'date': '2026-09-15', 'stars': 105}]}
+
+
+class HistoryTests(unittest.TestCase):
+    def test_new_day_preserves_old_counts_and_unstars(self):
+        before = history()
+        after = update.update_history(before, '2026-09-16', 103)
+        self.assertEqual(after['points'][:-1], before['points'])
+        self.assertEqual(after['points'][-1], {'date': '2026-09-16', 'stars': 103})
+        self.assertEqual(before, history())
+
+    def test_same_day_rerun_replaces_instead_of_appending(self):
+        first = update.update_history(history(), '2026-09-15', 107)
+        self.assertEqual(len(first['points']), 2)
+        self.assertEqual(first, update.update_history(first, '2026-09-15', 107))
+
+    def test_missing_days_are_not_invented(self):
+        result = update.update_history(history(), '2026-09-18', 106)
+        self.assertEqual([p['date'] for p in result['points']], ['2026-09-14', '2026-09-15', '2026-09-18'])
+
+    def test_rejects_wrong_repository_and_corrupt_history(self):
+        cases = []
+        wrong = history(); wrong['repository'] = 'someone/else'; cases.append(wrong)
+        duplicate = history(); duplicate['points'].append(duplicate['points'][-1]); cases.append(duplicate)
+        unordered = history(); unordered['points'].reverse(); cases.append(unordered)
+        negative = history(); negative['points'][0]['stars'] = -1; cases.append(negative)
+        future = history(); future['points'][-1]['date'] = '2026-09-20'; cases.append(future)
+        for case in cases:
+            with self.subTest(case=case), self.assertRaises(ValueError):
+                update.update_history(case, '2026-09-16', 100)
+
+    def test_first_run_has_no_fabricated_history(self):
+        result = update.update_history(None, '2026-09-16', 10)
+        self.assertFalse(result['bootstrap']['reconstructed'])
+        self.assertEqual(result['points'], [{'date': '2026-09-16', 'stars': 10}])
+
+
+class ContributorTests(unittest.TestCase):
+    def test_retries_truncated_json_before_using_it(self):
+        with patch('update.request', side_effect=[b'{"partial":', b'{"ok":true}']), patch('update.time.sleep'):
+            self.assertEqual(update.GitHub('').get('repos/pgsty/silo'), {'ok': True})
+
+    def test_paginates_past_one_full_page(self):
+        class API(update.GitHub):
+            def __init__(self): self.calls = []
+            def get(self, path):
+                self.calls.append(path)
+                return list(range(100)) if 'page=1&' in path else [100]
+        api = API()
+        self.assertEqual(len(list(api.issues('pgsty/silo'))), 101)
+        self.assertIn('state=all', api.calls[0])
+        self.assertIn('page=2&', api.calls[1])
+
+    def test_bots_deduplication_unmerged_work_and_reviewed_credit(self):
+        def issue(login, kind='issue', user_type='User'):
+            item = {'user': {'login': login, 'type': user_type, 'avatar_url': ''}, 'created_at': '2026-09-02T00:00:00Z'}
+            if kind != 'issue': item['pull_request'] = {'merged_at': None if kind == 'open' else '2026-09-03T00:00:00Z'}
+            return item
+        class API:
+            def issues(self, _repo):
+                return [issue('alice'), issue('Bob', 'open'), issue('Bob', 'merged'),
+                        issue('Carol', 'open'), issue('Copilot'), issue('robot', user_type='Bot')]
+        curated = {'repositories': ['pgsty/silo', 'pgsty/mc'], 'bots': ['Copilot'],
+                   'people': [person('Alice', featured=True), person('Reporter'), person('Copilot')]}
+        result = update.collect_people(API(), curated)
+        self.assertEqual({p['handle'] for p in result}, {'Alice', 'Bob', 'Carol', 'Reporter'})
+        self.assertEqual(result[0]['handle'], 'Bob')
+        self.assertEqual(result[1]['handle'], 'Carol')
+        self.assertTrue(next(p for p in result if p['handle'] == 'Alice')['featured'])
+        self.assertEqual(next(p for p in result if p['handle'] == 'Bob')['group'], 'code')
+        self.assertFalse(next(p for p in result if p['handle'] == 'Carol')['featured'])
+
+    def test_newer_reviewed_preview_survives_until_site_catches_up(self):
+        remote = {'updated': '2026-09-16T03:00:00+00:00'}
+        cached = {'updated': '2026-09-16T04:00:00+00:00'}
+        self.assertIs(update.select_curated(remote, cached), cached)
+        newer = {'updated': '2026-09-17T03:00:00+00:00'}
+        self.assertIs(update.select_curated(newer, cached), newer)
+
+    def test_avatar_failure_reuses_raster_cache(self):
+        previous = {**person(), 'avatarDataUrl': update.raster_data_url(PNG)}
+        with patch('update.request', side_effect=URLError('unavailable')):
+            result = update.add_avatars(None, [{**person(), 'avatarUrl': 'https://avatars.githubusercontent.com/u/1'}], [previous])
+        self.assertEqual(result[0]['avatarDataUrl'], previous['avatarDataUrl'])
+        with self.assertRaises(ValueError): update.raster_data_url(b'<svg onload="bad()"/>')
+        with self.assertRaises(ValueError): update.cached_avatar({'avatarDataUrl': 'data:image/svg+xml;base64,PHN2Zy8+'})
+
+    def test_fetch_failure_leaves_published_assets_untouched(self):
+        class API:
+            def get(self, path):
+                if path == 'repos/pgsty/silo': return {'full_name': 'pgsty/silo', 'stargazers_count': 106}
+                raise URLError('roster unavailable')
+        with tempfile.TemporaryDirectory() as directory:
+            out = Path(directory)
+            original = json.dumps(history())
+            (out / 'history.json').write_text(original)
+            (out / 'contributors-light.svg').write_text('previous image')
+            with self.assertRaises(URLError): update.refresh(out, API(), Path('.'))
+            self.assertEqual((out / 'history.json').read_text(), original)
+            self.assertEqual((out / 'contributors-light.svg').read_text(), 'previous image')
+
+
+class RenderTests(unittest.TestCase):
+    def test_real_emblem_generates_clean_xml(self):
+        emblem = render.read_emblem(Path(__file__).resolve().parents[2] / '.github/silo.svg')
+        svg = render.contributors('light', [person()], '2026-09-16', emblem)
+        ET.fromstring(svg)
+        self.assertTrue(all(line == line.rstrip() for line in svg.splitlines()))
+
+    def test_all_avatars_fit_when_the_roster_grows(self):
+        people = [{**person(f'person-{i}'), 'avatarDataUrl': update.raster_data_url(PNG)} for i in range(151)]
+        for theme in ('light', 'dark'):
+            root = ET.fromstring(render.contributors(theme, people, '2026-09-16', ''))
+            images = root.findall('.//s:image', NS)
+            self.assertEqual(len(images), 151)
+            footer = float(root.attrib['height']) - 42
+            self.assertTrue(all(float(i.attrib['y']) + float(i.attrib['height']) < footer for i in images))
+            self.assertTrue(all(i.attrib['href'].startswith('data:image/png;base64,') for i in images))
+
+    def test_untrusted_text_is_escaped(self):
+        data = [{**person(), 'what': '<script>alert("x")</script> & contributions'}]
+        svg = render.contributors('light', data, '2026-09-16', '')
+        root = ET.fromstring(svg)
+        self.assertEqual(root.findall('.//s:script', NS), [])
+        self.assertIn('&lt;script&gt;', svg)
+
+    def test_single_point_and_decreasing_star_history_render(self):
+        for data in (update.update_history(None, '2026-09-16', 0), update.update_history(history(), '2026-09-16', 90)):
+            for theme in ('light', 'dark'):
+                svg = render.stars(theme, data, '2026-09-16', '')
+                ET.fromstring(svg)
+                self.assertNotIn('nan', svg.lower())
+                self.assertNotIn('inf', svg.lower())
+
+
+if __name__ == '__main__':
+    unittest.main()
@@ -0,0 +1,295 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 Feng Ruohang
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+"""Refresh the generated-asset checkout; publishing is handled by the workflow."""
+
+import argparse
+import base64
+from concurrent.futures import ThreadPoolExecutor
+from datetime import date, datetime, timezone
+import json
+from http.client import IncompleteRead
+import os
+from pathlib import Path
+import re
+import sys
+import time
+from urllib.error import HTTPError, URLError
+from urllib.parse import urlparse
+from urllib.request import Request, urlopen
+import xml.etree.ElementTree as ET
+
+import yaml
+
+import render
+
+REPOSITORY = 'pgsty/silo'
+SOURCE = 'repos/pgsty/silo.pgsty.com/contents/data/home/contributors.yaml?ref=main'
+GROUPS = ('code', 'proposed', 'reports')
+HANDLE = re.compile(r'[A-Za-z0-9][A-Za-z0-9-]{0,38}\Z')
+
+
+def request(url, token='', limit=8 * 1024 * 1024):
+    headers = {'User-Agent': 'silo-repository-cards', 'Accept': 'application/vnd.github+json'}
+    if urlparse(url).netloc == 'api.github.com':
+        headers['X-GitHub-Api-Version'] = '2022-11-28'
+        if token:
+            headers['Authorization'] = f'Bearer {token}'
+    for attempt in range(3):
+        try:
+            with urlopen(Request(url, headers=headers), timeout=25) as response:
+                data = response.read(limit + 1)
+                if len(data) > limit:
+                    raise ValueError('Response exceeds the size limit')
+                expected = response.headers.get('Content-Length')
+                if expected is not None and len(data) != int(expected):
+                    raise URLError('Incomplete response body')
+                return data
+        except HTTPError as exc:
+            if exc.code < 500 or attempt == 2:
+                raise
+        except (URLError, TimeoutError, IncompleteRead):
+            if attempt == 2:
+                raise
+        time.sleep(attempt + 1)
+
+
+class GitHub:
+    def __init__(self, token):
+        self.token = token
+
+    def get(self, path):
+        for attempt in range(3):
+            try:
+                return json.loads(request('https://api.github.com/' + path, self.token))
+            except (json.JSONDecodeError, UnicodeDecodeError) as exc:
+                if attempt == 2:
+                    raise ValueError(f'Incomplete or invalid GitHub JSON: {path}') from exc
+                time.sleep(attempt + 1)
+
+    def issues(self, repository):
+        page = 1
+        while True:
+            batch = self.get(f'repos/{repository}/issues?state=all&per_page=100&page={page}&sort=created&direction=asc')
+            if not isinstance(batch, list):
+                raise ValueError(f'Invalid issues response for {repository}')
+            yield from batch
+            if len(batch) < 100:
+                return
+            page += 1
+
+
+def curated_snapshot(data, revision):
+    updated = str(data['updated'])
+    datetime.fromisoformat(updated)
+    repositories = [item['repo'] for item in data['repositories']]
+    if not repositories or any(not re.fullmatch(r'pgsty/[A-Za-z0-9_.-]+', repo) for repo in repositories):
+        raise ValueError('Invalid contributor repository scope')
+    people = []
+    for group in GROUPS:
+        for entry in data[group]:
+            if not HANDLE.fullmatch(entry['handle']):
+                raise ValueError('Invalid GitHub contributor handle')
+            people.append({
+                'handle': entry['handle'], 'group': group,
+                'featured': bool(entry.get('featured')), 'what': entry['what'],
+                'firstContribution': str(entry.get('firstContribution', '9999-12-31')),
+            })
+    if not people or len({p['handle'].lower() for p in people}) != len(people):
+        raise ValueError('Empty or duplicate contributor roster')
+    return {'updated': updated, 'revision': revision, 'repositories': repositories,
+            'bots': data.get('bots', ['Copilot', 'dependabot[bot]']), 'people': people}
+
+
+def select_curated(remote, cached):
+    # The initial, approved preview can contain reviewed credit not published by
+    # the companion site yet. Keep that newer snapshot until the site catches up.
+    if cached and datetime.fromisoformat(cached['updated']) > datetime.fromisoformat(remote['updated']):
+        return cached
+    return remote
+
+
+def collect_people(api, curated):
+    bots = {name.lower() for name in curated['bots']}
+    people = {p['handle'].lower(): dict(p) for p in curated['people']
+              if p['handle'].lower() not in bots and not p['handle'].lower().endswith('[bot]')}
+    order = {p['handle'].lower(): index for index, p in enumerate(curated['people'])}
+    for repository in curated['repositories']:
+        print(f'Reading issue and PR authors: {repository}', flush=True)
+        for issue in api.issues(repository):
+            user = issue.get('user') or {}
+            handle = user.get('login', '')
+            key = handle.lower()
+            if user.get('type') != 'User' or key in bots or key.endswith('[bot]'):
+                continue
+            if not HANDLE.fullmatch(handle):
+                raise ValueError('Invalid issue author')
+            pr = issue.get('pull_request')
+            group = 'code' if pr and pr.get('merged_at') else 'proposed' if pr else 'reports'
+            first = issue['created_at'][:10]
+            date.fromisoformat(first)
+            person = people.setdefault(key, {
+                'handle': handle, 'group': group, 'featured': False,
+                'what': 'Contributed an issue or pull request to SILO and related projects',
+                'firstContribution': first,
+            })
+            person['avatarUrl'] = user.get('avatar_url', '')
+            person['firstContribution'] = min(person['firstContribution'], first)
+            if GROUPS.index(group) < GROUPS.index(person['group']):
+                person['group'] = group
+    if not people:
+        raise ValueError('No human contributors were collected')
+    return sorted(people.values(), key=lambda p: (
+        GROUPS.index(p['group']), not p['featured'],
+        order.get(p['handle'].lower(), len(order)), p['firstContribution'], p['handle'].lower()))
+
+
+def raster_data_url(data):
+    if data.startswith(b'\x89PNG\r\n\x1a\n'):
+        mime = 'image/png'
+    elif data.startswith(b'\xff\xd8\xff'):
+        mime = 'image/jpeg'
+    elif data.startswith((b'GIF87a', b'GIF89a')):
+        mime = 'image/gif'
+    elif data[:4] == b'RIFF' and data[8:12] == b'WEBP':
+        mime = 'image/webp'
+    else:
+        raise ValueError('Avatar is not a raster image')
+    return f'data:{mime};base64,' + base64.b64encode(data).decode('ascii')
+
+
+def cached_avatar(person):
+    value = person.get('avatarDataUrl', '')
+    if not value:
+        return ''
+    prefix, encoded = value.split(',', 1)
+    if prefix not in ('data:image/png;base64', 'data:image/jpeg;base64', 'data:image/gif;base64', 'data:image/webp;base64'):
+        raise ValueError('Invalid cached avatar format')
+    raw = base64.b64decode(encoded, validate=True)
+    if len(raw) > 512 * 1024 or raster_data_url(raw) != value:
+        raise ValueError('Invalid cached avatar')
+    return value
+
+
+def add_avatars(api, people, previous):
+    cached = {p['handle'].lower(): cached_avatar(p) for p in previous}
+
+    def update(person):
+        person = dict(person)
+        try:
+            url = person.pop('avatarUrl', '') or api.get('users/' + person['handle'])['avatar_url']
+            parsed = urlparse(url)
+            if parsed.scheme != 'https' or parsed.netloc != 'avatars.githubusercontent.com':
+                raise ValueError('Unexpected avatar host')
+            data = request(url + ('&' if '?' in url else '?') + 's=96', limit=512 * 1024)
+            person['avatarDataUrl'] = raster_data_url(data)
+        except (HTTPError, URLError, TimeoutError, IncompleteRead, ValueError, KeyError) as exc:
+            person.pop('avatarUrl', None)
+            person['avatarDataUrl'] = cached.get(person['handle'].lower(), '')
+            print(f'Avatar fallback for @{person["handle"]}: {type(exc).__name__}', file=sys.stderr)
+        return person
+
+    with ThreadPoolExecutor(max_workers=6) as pool:
+        return list(pool.map(update, people))
+
+
+def update_history(history, day, stars):
+    date.fromisoformat(day)
+    if type(stars) is not int or stars < 0:
+        raise ValueError('Invalid repository star count')
+    if history is None:
+        history = {'repository': REPOSITORY, 'bootstrap': {'through': day, 'reconstructed': False}, 'points': []}
+    if history['repository'] != REPOSITORY:
+        raise ValueError('Star history belongs to a different repository')
+    date.fromisoformat(history['bootstrap']['through'])
+    dates = []
+    for point in history['points']:
+        date.fromisoformat(point['date'])
+        if type(point['stars']) is not int or point['stars'] < 0:
+            raise ValueError('Invalid historical star count')
+        dates.append(point['date'])
+    if dates != sorted(set(dates)) or any(d > day for d in dates):
+        raise ValueError('History contains duplicate, unordered, or future dates')
+    # Replace today's observation, preserve previous days, and allow unstars.
+    points = [dict(p) for p in history['points'] if p['date'] != day]
+    points.append({'date': day, 'stars': stars})
+    return {**history, 'points': points}
+
+
+def read_json(path, default=None):
+    return json.loads(path.read_text()) if path.exists() else default
+
+
+def refresh(output, api, source_root):
+    day = datetime.now(timezone.utc).date().isoformat()
+    metadata = api.get('repos/' + REPOSITORY)
+    if metadata['full_name'].lower() != REPOSITORY:
+        raise ValueError('Unexpected repository metadata')
+    history = update_history(read_json(output / 'history.json'), day, metadata['stargazers_count'])
+    source = api.get(SOURCE)
+    reviewed = yaml.safe_load(base64.b64decode(source['content'], validate=False))
+    curated = select_curated(curated_snapshot(reviewed, source['sha']), read_json(output / 'curated.json'))
+    people = collect_people(api, curated)
+    previous = read_json(output / 'contributors.json', {}).get('people', [])
+    people = add_avatars(api, people, previous)
+    emblem = render.read_emblem(source_root / '.github/silo.svg')
+    payloads = {}
+    for theme in ('light', 'dark'):
+        payloads[f'contributors-{theme}.svg'] = render.contributors(theme, people, day, emblem) + '\n'
+        payloads[f'star-history-{theme}.svg'] = render.stars(theme, history, day, emblem) + '\n'
+    for svg in payloads.values():
+        ET.fromstring(svg)
+    for name, data in {
+        'history.json': history,
+        'curated.json': curated,
+        'contributors.json': {'repository': REPOSITORY, 'updated': day, 'people': people},
+    }.items():
+        payloads[name] = json.dumps(data, indent=2, ensure_ascii=False) + '\n'
+    payloads['README.md'] = f'''# SILO repository cards
+
+Generated by [Repository Cards](https://github.com/pgsty/silo/actions/workflows/repository-cards.yml)
+at 00:00 UTC daily (08:00 Asia/Shanghai). GitHub may queue scheduled runs.
+
+Snapshot: {day}. {metadata['stargazers_count']:,} stars; {len(people)} community contributors.
+
+- `contributors-light.svg` / `contributors-dark.svg`: human issue and PR authors across the SILO project scope, plus reviewed acknowledgements. Bots are excluded. Gold rings follow the reviewed companion-site roster; new authors are collected automatically.
+- `star-history-light.svg` / `star-history-dark.svg`: initial history reconstructed from the then-current stargazers; later points are daily observed totals, including decreases. Missing days are not fabricated.
+- `curated.json`: a cache of reviewed contributor credit from `pgsty/silo.pgsty.com/data/home/contributors.yaml`. The approved initial preview may be newer than the published site; a newer reviewed snapshot is retained until the site catches up.
+- `contributors.json`: generated contributor data and embedded raster avatars. Failed avatar refreshes use the previous image, or an initial when no image is available.
+- `history.json`: persistent daily totals. Keep this file when regenerating images.
+
+The SVGs are self-contained. Source and instructions live on the default branch;
+this branch contains generated assets only. Do not merge it into `main`.
+'''
+    # Collect and validate everything before touching the publication checkout.
+    output.mkdir(parents=True, exist_ok=True)
+    for filename, text in payloads.items():
+        (output / filename).write_text(text)
+    print(f'{day}: {len(people)} contributors; {metadata["stargazers_count"]:,} stars; {len(history["points"])} history points')
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--output', type=Path, required=True)
+    args = parser.parse_args()
+    configured = os.environ.get('GITHUB_REPOSITORY', REPOSITORY)
+    if configured.lower() != REPOSITORY:
+        raise SystemExit('This workflow is scoped to pgsty/silo')
+    refresh(args.output, GitHub(os.environ.get('GH_TOKEN', '')), Path(__file__).resolve().parents[2])
+
+
+if __name__ == '__main__':
+    main()
@@ -163,6 +163,7 @@ func registerAdminRouter(router *mux.Router, enableConfigOps bool) {

 		// StorageInfo operations
 		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/storageinfo").HandlerFunc(adminMiddleware(adminAPI.StorageInfoHandler, traceAllFlag))
+		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/multipart-preflight").HandlerFunc(adminMiddleware(adminAPI.MultipartPreflightHandler, traceAllFlag))
 		// DataUsageInfo operations
 		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/datausageinfo").HandlerFunc(adminMiddleware(adminAPI.DataUsageInfoHandler, traceAllFlag))
 		// Metrics operation
@@ -450,6 +450,9 @@ const (
 	ErrAdminNoSecretKey

 	ErrIAMNotInitialized
+	ErrMultipartListingLegacy
+	ErrMultipartListingIdentity
+	ErrSlowDown

 	apiErrCodeEnd // This is used only for the testing code
 )
@@ -1336,6 +1339,21 @@ var errorCodes = errorCodeMap{
 		Description:    "IAM sub-system not initialized yet, please try again.",
 		HTTPStatusCode: http.StatusServiceUnavailable,
 	},
+	ErrMultipartListingLegacy: {
+		Code:           "MultipartListingNotReady",
+		Description:    "Legacy multipart uploads prevent a complete listing. Upgrade all writers, drain old uploads and run the multipart preflight check.",
+		HTTPStatusCode: http.StatusServiceUnavailable,
+	},
+	ErrMultipartListingIdentity: {
+		Code:           "MultipartListingMetadataInvalid",
+		Description:    "Multipart upload metadata is inconsistent. Run the multipart preflight check to locate the affected storage set.",
+		HTTPStatusCode: http.StatusServiceUnavailable,
+	},
+	ErrSlowDown: {
+		Code:           "SlowDown",
+		Description:    "Please reduce your request rate",
+		HTTPStatusCode: http.StatusServiceUnavailable,
+	},
 	ErrBucketMetadataNotInitialized: {
 		Code:           "XMinioBucketMetadataNotInitialized",
 		Description:    "Bucket metadata not initialized yet, please try again.",
@@ -2173,6 +2191,10 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 	err = unwrapAll(err)

 	switch err {
+	case errMultipartListingLegacy:
+		apiErr = ErrMultipartListingLegacy
+	case errMultipartListingIdentity:
+		apiErr = ErrMultipartListingIdentity
 	case errCompleteMultipartChecksumMismatch, errCompleteMultipartChecksumTypeMismatch:
 		apiErr = ErrBadDigest
 	case errMissingPartChecksum:
@@ -2303,6 +2325,8 @@ func toAPIErrorCode(ctx context.Context, err error) (apiErr APIErrorCode) {
 	}

 	switch err.(type) {
+	case SlowDown:
+		apiErr = ErrSlowDown
 	case StorageFull:
 		apiErr = ErrStorageFull
 	case hash.BadDigest:
@@ -41,7 +41,7 @@ import (
 const (
 	maxObjectList  = 1000  // Limit number of objects in a listObjectsResponse/listObjectsVersionsResponse.
 	maxDeleteList  = 1000  // Limit number of objects deleted in a delete call.
-	maxUploadsList = 10000 // Limit number of uploads in a listUploadsResponse.
+	maxUploadsList = 1000  // Limit number of uploads in a listUploadsResponse.
 	maxPartsList   = 10000 // Limit number of parts in a listPartsResponse.
 )

@@ -277,14 +277,6 @@ func (api objectAPIHandlers) ListMultipartUploadsHandler(w http.ResponseWriter,
 		return
 	}

-	if keyMarker != "" {
-		// Marker not common with prefix is not implemented.
-		if !HasPrefix(keyMarker, prefix) {
-			writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
-			return
-		}
-	}
-
 	listMultipartsInfo, err := objectAPI.ListMultipartUploads(ctx, bucket, prefix, keyMarker, uploadIDMarker, delimiter, maxUploads)
 	if err != nil {
 		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
@@ -425,7 +425,7 @@ func testListMultipartUploadsHandler(obj ObjectLayer, instanceType, bucketName s
 			shouldPass:         true,
 		},
 		// Test case - 4.
-		// Setting Invalid prefix and marker combination.
+		// A key marker outside the prefix is valid and produces an empty page.
 		{
 			bucket:             bucketName,
 			prefix:             "asia",
@@ -435,8 +435,8 @@ func testListMultipartUploadsHandler(obj ObjectLayer, instanceType, bucketName s
 			maxUploads:         "0",
 			accessKey:          credentials.AccessKey,
 			secretKey:          credentials.SecretKey,
-			expectedRespStatus: http.StatusNotImplemented,
-			shouldPass:         false,
+			expectedRespStatus: http.StatusOK,
+			shouldPass:         true,
 		},
 		// Test case - 5.
 		// Invalid upload id and marker combination.
@@ -418,6 +418,9 @@ func getReplicationState(rinfos replicatedInfos, prevState ReplicationState, vID

 	for _, rinfo := range rinfos.Targets {
 		if rinfo.ResyncTimestamp != "" {
+			if rs.ResetStatusesMap == nil {
+				rs.ResetStatusesMap = make(map[string]string)
+			}
 			rs.ResetStatusesMap[targetResetHeader(rinfo.Arn)] = rinfo.ResyncTimestamp
 		}
 	}
@@ -425,6 +425,7 @@ func checkReplicateDelete(ctx context.Context, bucket string, dobj ObjectToDelet
 // the mere presence or absence of the target version.
 func replicateDelete(ctx context.Context, dobj DeletedObjectReplicationInfo, objectAPI ObjectLayer) replicatedInfos {
 	var replicationStatus replication.StatusType
+	isPurge := dobj.isVersionPurge()
 	bucket := dobj.Bucket
 	versionID := dobj.DeleteMarkerVersionID
 	if versionID == "" {
@@ -484,6 +485,7 @@ func replicateDelete(ctx context.Context, dobj DeletedObjectReplicationInfo, obj
 	lk := objectAPI.NewNSLock(bucket, "/[replicate]/"+dobj.ObjectName)
 	lkctx, err := lk.GetLock(ctx, globalOperationTimeout)
 	if err != nil {
+		dobj.RetryCount++
 		globalReplicationPool.Get().queueMRFSave(dobj.ToMRFEntry())
 		sendEvent(eventArgs{
 			BucketName: bucket,
@@ -546,25 +548,38 @@ func replicateDelete(ctx context.Context, dobj DeletedObjectReplicationInfo, obj
 	replicationStatus = rinfos.ReplicationStatus()
 	prevStatus := dobj.DeleteMarkerReplicationStatus()

-	if dobj.VersionID != "" {
-		prevStatus = replication.StatusType(dobj.VersionPurgeStatus())
-		replicationStatus = replication.StatusType(rinfos.VersionPurgeStatus())
+	if isPurge {
+		prevStatus = purgeReplicationStatus(dobj.VersionPurgeStatus())
+		replicationStatus = purgeReplicationStatus(rinfos.VersionPurgeStatus())
 	}

 	// to decrement pending count later.
 	for _, rinfo := range rinfos.Targets {
-		if rinfo.ReplicationStatus != rinfo.PrevReplicationStatus {
-			globalReplicationStats.Load().Update(dobj.Bucket, rinfo, replicationStatus,
-				prevStatus)
+		status, previous := rinfo.ReplicationStatus, rinfo.PrevReplicationStatus
+		if isPurge {
+			status = purgeReplicationStatus(rinfo.VersionPurgeStatus)
+			previous = purgeReplicationStatus(dobj.ReplicationState.PurgeTargets[rinfo.Arn])
+		}
+		if status != previous {
+			globalReplicationStats.Load().Update(dobj.Bucket, rinfo, status, previous)
 		}
 	}

 	eventName := event.ObjectReplicationComplete
 	if replicationStatus == replication.Failed {
 		eventName = event.ObjectReplicationFailed
+		dobj.RetryCount++
 		globalReplicationPool.Get().queueMRFSave(dobj.ToMRFEntry())
 	}
 	drs := getReplicationState(rinfos, dobj.ReplicationState, dobj.VersionID)
+	if isPurge {
+		// A purge must not rewrite the marker's creation/replica metadata.
+		// Multiple serialized empty target statuses can parse as nonempty,
+		// so explicitly send an empty creation update to the metadata writer.
+		drs.ReplicationStatusInternal = ""
+		drs.Targets = nil
+		drs.ReplicaStatus = ""
+	}
 	if replicationStatus != prevStatus {
 		drs.ReplicationTimeStamp = UTCNow()
 	}
@@ -606,6 +621,7 @@ func replicateDelete(ctx context.Context, dobj DeletedObjectReplicationInfo, obj
 }

 func replicateDeleteToTarget(ctx context.Context, dobj DeletedObjectReplicationInfo, tgt *TargetClient) (rinfo replicatedTargetInfo) {
+	isPurge := dobj.isVersionPurge()
 	versionID := dobj.DeleteMarkerVersionID
 	if versionID == "" {
 		versionID = dobj.VersionID
@@ -615,42 +631,50 @@ func replicateDeleteToTarget(ctx context.Context, dobj DeletedObjectReplicationI
 	rinfo.OpType = dobj.OpType
 	rinfo.endpoint = tgt.EndpointURL().Host
 	rinfo.secure = tgt.EndpointURL().Scheme == "https"
+	// A purge leaves ReplicationStatus empty: the metadata writer interprets
+	// that as preserving the entire creation-status block, including targets
+	// outside this fan-out. Only VersionPurgeStatus records the purge outcome.
 	defer func() {
-		if rinfo.ReplicationStatus == replication.Completed && tgt.ResetID != "" && dobj.OpType == replication.ExistingObjectReplicationType {
+		completed := rinfo.ReplicationStatus == replication.Completed
+		if isPurge {
+			completed = rinfo.VersionPurgeStatus == replication.VersionPurgeComplete
+		}
+		if completed && tgt.ResetID != "" && dobj.OpType == replication.ExistingObjectReplicationType {
 			rinfo.ResyncTimestamp = fmt.Sprintf("%s;%s", UTCNow().Format(http.TimeFormat), tgt.ResetID)
 		}
 	}()

-	if dobj.VersionID == "" && rinfo.PrevReplicationStatus == replication.Completed && dobj.OpType != replication.ExistingObjectReplicationType {
+	if !isPurge && rinfo.PrevReplicationStatus == replication.Completed && dobj.OpType != replication.ExistingObjectReplicationType {
 		rinfo.ReplicationStatus = rinfo.PrevReplicationStatus
 		return rinfo
 	}
-	if dobj.VersionID != "" && rinfo.VersionPurgeStatus == replication.VersionPurgeComplete {
+	if isPurge && rinfo.VersionPurgeStatus == replication.VersionPurgeComplete {
 		return rinfo
 	}
 	if globalBucketTargetSys.isOffline(tgt.EndpointURL()) {
-		replLogOnceIf(ctx, fmt.Errorf("remote target is offline for bucket:%s arn:%s", dobj.Bucket, tgt.ARN), "replication-target-offline-delete-"+tgt.ARN)
+		rinfo.Err = fmt.Errorf("remote target is offline for bucket:%s arn:%s", dobj.Bucket, tgt.ARN)
+		replLogOnceIf(ctx, rinfo.Err, "replication-target-offline-delete-"+tgt.ARN)
 		sendEvent(eventArgs{
 			BucketName: dobj.Bucket,
 			Object: ObjectInfo{
 				Bucket:       dobj.Bucket,
 				Name:         dobj.ObjectName,
-				VersionID:    dobj.VersionID,
+				VersionID:    versionID,
 				DeleteMarker: dobj.DeleteMarker,
 			},
 			UserAgent: "Internal: [Replication]",
 			Host:      globalLocalNodeName,
 			EventName: event.ObjectReplicationNotTracked,
 		})
-		if dobj.VersionID == "" {
-			rinfo.ReplicationStatus = replication.Failed
-		} else {
+		if isPurge {
 			rinfo.VersionPurgeStatus = replication.VersionPurgeFailed
+		} else {
+			rinfo.ReplicationStatus = replication.Failed
 		}
 		return rinfo
 	}
 	// early return if already replicated delete marker for existing object replication/ healing delete markers
-	if dobj.DeleteMarkerVersionID != "" {
+	if !isPurge && dobj.DeleteMarkerVersionID != "" {
 		toi, err := tgt.StatObject(ctx, tgt.Bucket, dobj.ObjectName, minio.StatObjectOptions{
 			VersionID: versionID,
 			Internal: minio.AdvancedGetOptions{
@@ -662,16 +686,10 @@ func replicateDeleteToTarget(ctx context.Context, dobj DeletedObjectReplicationI
 		switch {
 		case isErrMethodNotAllowed(serr):
 			// delete marker already replicated
-			if dobj.VersionID == "" && rinfo.VersionPurgeStatus.Empty() {
-				rinfo.ReplicationStatus = replication.Completed
-				return rinfo
-			}
+			rinfo.ReplicationStatus = replication.Completed
+			return rinfo
 		case isErrObjectNotFound(serr), isErrVersionNotFound(serr):
-			// version being purged is already not found on target.
-			if !rinfo.VersionPurgeStatus.Empty() {
-				rinfo.VersionPurgeStatus = replication.VersionPurgeComplete
-				return rinfo
-			}
+			// The marker still needs to be created on the target.
 		case isErrReadQuorum(serr), isErrWriteQuorum(serr):
 			// destination has some quorum issues, perform removeObject() anyways
 			// to complete the operation.
@@ -691,7 +709,7 @@ func replicateDeleteToTarget(ctx context.Context, dobj DeletedObjectReplicationI
 	rmErr := tgt.RemoveObject(ctx, tgt.Bucket, dobj.ObjectName, minio.RemoveObjectOptions{
 		VersionID: versionID,
 		Internal: minio.AdvancedRemoveOptions{
-			ReplicationDeleteMarker: dobj.DeleteMarkerVersionID != "",
+			ReplicationDeleteMarker: !isPurge && dobj.DeleteMarkerVersionID != "",
 			ReplicationMTime:        dobj.DeleteMarkerMTime.Time,
 			ReplicationStatus:       minio.ReplicationStatusReplica,
 			ReplicationRequest:      true, // always set this to distinguish between `mc mirror` replication and serverside
@@ -699,20 +717,20 @@ func replicateDeleteToTarget(ctx context.Context, dobj DeletedObjectReplicationI
 	})
 	if rmErr != nil {
 		rinfo.Err = rmErr
-		if dobj.VersionID == "" {
-			rinfo.ReplicationStatus = replication.Failed
-		} else {
+		if isPurge {
 			rinfo.VersionPurgeStatus = replication.VersionPurgeFailed
+		} else {
+			rinfo.ReplicationStatus = replication.Failed
 		}
 		replLogIf(ctx, fmt.Errorf("unable to replicate delete marker to %s: %s/%s(%s): %w", tgt.EndpointURL(), tgt.Bucket, dobj.ObjectName, versionID, rmErr))
 		if rmErr != nil && minio.IsNetworkOrHostDown(rmErr, true) && !globalBucketTargetSys.isOffline(tgt.EndpointURL()) {
 			globalBucketTargetSys.markOffline(tgt.EndpointURL())
 		}
 	} else {
-		if dobj.VersionID == "" {
-			rinfo.ReplicationStatus = replication.Completed
-		} else {
+		if isPurge {
 			rinfo.VersionPurgeStatus = replication.VersionPurgeComplete
+		} else {
+			rinfo.ReplicationStatus = replication.Completed
 		}
 	}
 	return rinfo
@@ -781,6 +799,18 @@ func (m caseInsensitiveMap) Lookup(key string) (string, bool) {
 	return "", false
 }

+// replicationTaggingTimestamp carries a recorded removal even when tags are
+// empty. Only legacy nonempty tags use ModTime; absence is not a tombstone.
+func replicationTaggingTimestamp(objInfo ObjectInfo) (time.Time, error) {
+	if stamp, ok := caseInsensitiveMap(objInfo.UserDefined).Lookup(ReservedMetadataPrefixLower + TaggingTimestamp); ok {
+		return time.Parse(time.RFC3339Nano, stamp)
+	}
+	if objInfo.UserTags != "" {
+		return objInfo.ModTime, nil
+	}
+	return time.Time{}, nil
+}
+
 func putReplicationOpts(ctx context.Context, sc string, objInfo ObjectInfo) (putOpts minio.PutObjectOptions, isMP bool, err error) {
 	meta := make(map[string]string)
 	isSSEC := crypto.SSEC.IsEncrypted(objInfo.UserDefined)
@@ -850,17 +880,12 @@ func putReplicationOpts(ctx context.Context, sc string, objInfo ObjectInfo) (put
 		tag, _ := tags.ParseObjectTags(objInfo.UserTags)
 		if tag != nil {
 			putOpts.UserTags = tag.ToMap()
-			// set tag timestamp in opts
-			tagTimestamp := objInfo.ModTime
-			if tagTmstampStr, ok := objInfo.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp]; ok {
-				tagTimestamp, err = time.Parse(time.RFC3339Nano, tagTmstampStr)
-				if err != nil {
-					return putOpts, false, err
-				}
-			}
-			putOpts.Internal.TaggingTimestamp = tagTimestamp
 		}
 	}
+	putOpts.Internal.TaggingTimestamp, err = replicationTaggingTimestamp(objInfo)
+	if err != nil {
+		return putOpts, false, err
+	}

 	lkMap := caseInsensitiveMap(objInfo.UserDefined)
 	if lang, ok := lkMap.Lookup(xhttp.ContentLanguage); ok {
@@ -1003,6 +1028,12 @@ func getReplicationAction(oi1 ObjectInfo, oi2 minio.ObjectInfo, opType replicati
 	if (oi2.UserTagCount > 0 && !reflect.DeepEqual(oi2Map, t.ToMap())) || (oi2.UserTagCount != len(t.ToMap())) {
 		return replicateMetadata
 	}
+	// HEAD does not report the tag revision. Equal values can hide a newer
+	// deletion or re-addition, so scheduled metadata/heal work must deliver it.
+	// Completed objects are still excluded by the existing scanner gates.
+	if _, ok := caseInsensitiveMap(oi1.UserDefined).Lookup(ReservedMetadataPrefixLower + TaggingTimestamp); ok {
+		return replicateMetadata
+	}

 	// Compare only necessary headers
 	compareKeys := []string{
@@ -1269,9 +1300,6 @@ func replicateObject(ctx context.Context, ri ReplicateObjectInfo, objectAPI Obje
 						oi.UserDefined[targetResetHeader(rinfo.Arn)] = rinfo.ResyncTimestamp
 					}
 				}
-				if ri.UserTags != "" {
-					oi.UserDefined[xhttp.AmzObjectTagging] = ri.UserTags
-				}
 				return dsc, nil
 			},
 		}
@@ -1689,14 +1717,11 @@ applyAction:
 		if _, ok := lkMap.Lookup(xhttp.AmzObjectLockRetainUntilDate); ok {
 			dstOpts.Internal.RetentionTimestamp = objInfo.ModTime
 		}
-		if objInfo.UserTags != "" {
-			dstOpts.Internal.TaggingTimestamp = objInfo.ModTime
-		}
-		if tagTmStr, ok := lkMap.Lookup(ReservedMetadataPrefixLower + TaggingTimestamp); ok {
-			ondiskTimestamp, err := time.Parse(time.RFC3339, tagTmStr)
-			if err == nil {
-				dstOpts.Internal.TaggingTimestamp = ondiskTimestamp
-			}
+		dstOpts.Internal.TaggingTimestamp, rinfo.Err = replicationTaggingTimestamp(objInfo)
+		if rinfo.Err != nil {
+			rinfo.ReplicationStatus = replication.Failed
+			replLogIf(ctx, fmt.Errorf("invalid tagging timestamp for object %s/%s(%s): %w", bucket, object, objInfo.VersionID, rinfo.Err))
+			return rinfo
 		}
 		if retTmStr, ok := lkMap.Lookup(ReservedMetadataPrefixLower + ObjectLockRetentionTimestamp); ok {
 			ondiskTimestamp, err := time.Parse(time.RFC3339, retTmStr)
@@ -1916,11 +1941,26 @@ func filterReplicationStatusMetadata(metadata map[string]string) map[string]stri
 // DeletedObjectReplicationInfo has info on deleted object
 type DeletedObjectReplicationInfo struct {
 	DeletedObject
-	Bucket    string
-	EventType string
-	OpType    replication.Type
-	ResetID   string
-	TargetArn string
+	Bucket     string
+	EventType  string
+	OpType     replication.Type
+	ResetID    string
+	TargetArn  string
+	RetryCount int
+}
+
+// isVersionPurge also recognizes the old marker-shaped purge task. Use the
+// operation's state, rather than one target's possibly missing purge entry.
+func (di DeletedObjectReplicationInfo) isVersionPurge() bool {
+	return di.VersionID != "" || di.DeleteMarkerVersionID != "" && !di.VersionPurgeStatus().Empty()
+}
+
+// Purge metadata uses COMPLETE; operation statistics and audit use COMPLETED.
+func purgeReplicationStatus(status VersionPurgeStatusType) replication.StatusType {
+	if replication.StatusType(status) == replication.CompletedLegacy {
+		return replication.Completed
+	}
+	return replication.StatusType(status)
 }

 // ToMRFEntry returns the relevant info needed by MRF
@@ -1930,9 +1970,10 @@ func (di DeletedObjectReplicationInfo) ToMRFEntry() MRFReplicateEntry {
 		versionID = di.VersionID
 	}
 	return MRFReplicateEntry{
-		Bucket:    di.Bucket,
-		Object:    di.ObjectName,
-		versionID: versionID,
+		Bucket:     di.Bucket,
+		Object:     di.ObjectName,
+		versionID:  versionID,
+		RetryCount: di.RetryCount,
 	}
 }

@@ -2424,6 +2465,7 @@ func (p *ReplicationPool) queueReplicaDeleteTask(doi DeletedObjectReplicationInf
 	case <-p.ctx.Done():
 	case ch <- doi:
 	default:
+		doi.RetryCount++
 		p.queueMRFSave(doi.ToMRFEntry())
 		p.mu.RLock()
 		prio := p.priority
@@ -3787,9 +3829,10 @@ func queueReplicationHeal(ctx context.Context, bucket string, oi ObjectInfo, rcf
 				DeleteMarkerMTime:     DeleteMarkerMTime{roi.ModTime},
 				DeleteMarker:          roi.DeleteMarker,
 			},
-			Bucket:    roi.Bucket,
-			OpType:    replication.HealReplicationType,
-			EventType: ReplicateHealDelete,
+			Bucket:     roi.Bucket,
+			OpType:     replication.HealReplicationType,
+			EventType:  ReplicateHealDelete,
+			RetryCount: retryCount,
 		}
 		// heal delete marker replication failure or versioned delete replication failure
 		if roi.ReplicationStatus == replication.Pending ||
@@ -4072,7 +4115,12 @@ func (p *ReplicationPool) queueMRFHeal() error {
 				VersionID: vID,
 			})
 			cancel()
-			if err != nil {
+			// A versioned marker lookup returns its metadata with a 405. Only
+			// accept that error with a real, matching marker identity.
+			validMarker := isErrMethodNotAllowed(err) && oi.DeleteMarker &&
+				vID != "" && oi.VersionID == vID && !oi.ModTime.IsZero() &&
+				oi.Bucket == e.Bucket && oi.Name != "" && oi.Name == decodeDirObject(e.Object)
+			if err != nil && !validMarker || oi.Name == "" {
 				continue
 			}

@@ -445,6 +445,7 @@ func buildServerCtxt(ctx *cli.Context, ctxt *serverCtxt) (err error) {
 	ctxt.SendBufSize = ctx.Int("send-buf-size")
 	ctxt.RecvBufSize = ctx.Int("recv-buf-size")
 	ctxt.IdleTimeout = ctx.Duration("idle-timeout")
+	ctxt.ReadHeaderTimeout = ctx.Duration("read-header-timeout")
 	ctxt.UserTimeout = ctx.Duration("conn-user-timeout")

 	if conf := ctx.String("config"); len(conf) > 0 {
@@ -0,0 +1,385 @@
+// Copyright (c) 2026 mr javad seydi and Ruohang Feng
+//
+// This file is part of Silo Object Storage stack.
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+package cmd
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/pgsty/silo-pkg/v3/policy"
+)
+
+const multipartScanEntryLimit = 100_000
+
+var (
+	multipartScanSlots          = make(chan struct{}, 2)
+	errMultipartListingLegacy   = errors.New("legacy multipart uploads require a coordinated upgrade and drain")
+	errMultipartListingIdentity = errors.New("multipart upload identity is invalid")
+)
+
+// One budget and admission slot cover the entire request, including all pools.
+// A slot is released only after the scan workers have actually stopped.
+type multipartScan struct {
+	ctx           context.Context
+	cancel        context.CancelFunc
+	remaining     atomic.Int64
+	metadataSlots chan struct{}
+	preflight     bool
+	sets          []multipartScanSet
+}
+
+type multipartScanSet struct {
+	Pool            int       `json:"pool"`
+	Set             int       `json:"set"`
+	Drives          int       `json:"drives"`
+	ScannedDrives   int       `json:"scannedDrives"`
+	UncoveredDrives []int     `json:"uncoveredDrives,omitempty"`
+	Candidates      int       `json:"candidates"`
+	LegacyUploads   int       `json:"legacyUploads"`
+	OldestLegacy    time.Time `json:"oldestLegacy,omitempty"`
+	Error           string    `json:"error,omitempty"`
+}
+
+type multipartPreflightReport struct {
+	Ready          bool               `json:"ready"`
+	Complete       bool               `json:"complete"`
+	Mode           string             `json:"mode"`
+	ScannedEntries int64              `json:"scannedEntries"`
+	LegacyUploads  int                `json:"legacyUploads"`
+	Sets           []multipartScanSet `json:"sets"`
+}
+
+func startMultipartScan(ctx context.Context, preflight bool) (*multipartScan, error) {
+	select {
+	case multipartScanSlots <- struct{}{}:
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+		return nil, SlowDown{}
+	}
+	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	s := &multipartScan{ctx: ctx, cancel: cancel, preflight: preflight, metadataSlots: make(chan struct{}, multipartMetadataScanConcurrency)}
+	s.remaining.Store(multipartScanEntryLimit)
+	return s, nil
+}
+
+func (s *multipartScan) close() {
+	s.cancel()
+	<-multipartScanSlots
+}
+
+func (s *multipartScan) listDir(disk StorageAPI, bucket, dir string) ([]string, error) {
+	if err := s.ctx.Err(); err != nil {
+		return nil, SlowDown{}
+	}
+	remaining := s.remaining.Load()
+	if remaining <= 0 {
+		return nil, SlowDown{}
+	}
+	// Request one extra entry to detect overflow, never a silently partial page.
+	entries, err := disk.ListDir(s.ctx, bucket, minioMetaMultipartBucket, dir, int(remaining)+1)
+	if errors.Is(err, errFileNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	if s.remaining.Add(-int64(len(entries))) < 0 {
+		return nil, SlowDown{}
+	}
+	return entries, nil
+}
+
+func (s *multipartScan) listUploadDirs(disk StorageAPI, bucket string) ([]string, error) {
+	hashDirs, err := s.listDir(disk, bucket, "")
+	if err != nil {
+		return nil, err
+	}
+	var candidates []string
+	for _, hashDir := range hashDirs {
+		if !strings.HasSuffix(hashDir, SlashSeparator) {
+			continue
+		}
+		hashDir = strings.TrimSuffix(hashDir, SlashSeparator)
+		uploadDirs, err := s.listDir(disk, bucket, hashDir)
+		if err != nil {
+			return nil, err
+		}
+		for _, uploadDir := range uploadDirs {
+			if strings.HasSuffix(uploadDir, SlashSeparator) {
+				candidates = append(candidates, pathJoin(hashDir, strings.TrimSuffix(uploadDir, SlashSeparator)))
+			}
+		}
+	}
+	return candidates, nil
+}
+
+// Identity is immutable at hash/uploadUUID. Check the hash before using even
+// a single source drive to exclude another bucket. Missing/bad identities must
+// fall back to the full metadata read; they cannot prove absence.
+func (er erasureObjects) multipartIdentity(fi FileInfo, shaDir string) (string, string, bool) {
+	bucket, object := fi.Metadata[multipartMetaBucket], fi.Metadata[multipartMetaObject]
+	return bucket, object, bucket != "" && object != "" && IsValidBucketName(bucket) &&
+		IsValidObjectPrefix(object) && er.getMultipartSHADir(bucket, object) == shaDir
+}
+
+func (er erasureObjects) readMultipartUploadCandidate(s *multipartScan, bucket, candidate string, source StorageAPI) (MultipartInfo, bool, bool, error) {
+	if s.ctx.Err() != nil {
+		return MultipartInfo{}, false, false, SlowDown{}
+	}
+	shaDir, uploadUUID, ok := strings.Cut(candidate, SlashSeparator)
+	if !ok || shaDir == "" || uploadUUID == "" || strings.Contains(uploadUUID, SlashSeparator) {
+		return MultipartInfo{}, false, false, errMultipartListingIdentity
+	}
+	if !s.preflight && bucket != "" && source != nil {
+		fi, err := source.ReadVersion(s.ctx, bucket, minioMetaMultipartBucket, candidate, "", ReadOptions{})
+		if err == nil {
+			storedBucket, _, valid := er.multipartIdentity(fi, shaDir)
+			if valid && storedBucket != bucket {
+				return MultipartInfo{}, false, false, nil
+			}
+		}
+	}
+	if s.ctx.Err() != nil {
+		return MultipartInfo{}, false, false, SlowDown{}
+	}
+	select {
+	case s.metadataSlots <- struct{}{}:
+		defer func() { <-s.metadataSlots }()
+	case <-s.ctx.Done():
+		return MultipartInfo{}, false, false, SlowDown{}
+	}
+	disks := er.getDisks()
+	metadata, errs := readAllFileInfo(s.ctx, disks, bucket, minioMetaMultipartBucket, candidate, "", false, false)
+	if s.preflight {
+		// Readiness is stronger than listing liveness: even one readable legacy
+		// copy must be drained, and an unreadable copy cannot certify readiness.
+		var oldest MultipartInfo
+		legacy := false
+		_, nativeID := multipartUploadTime(uploadUUID)
+		for i, err := range errs {
+			if errors.Is(err, errFileNotFound) || errors.Is(err, errFileVersionNotFound) {
+				continue
+			}
+			if err != nil {
+				return MultipartInfo{}, false, false, err
+			}
+			fi := metadata[i]
+			storedBucket, storedObject, valid := er.multipartIdentity(fi, shaDir)
+			if storedBucket != "" && storedObject != "" && !valid {
+				return MultipartInfo{}, false, false, errMultipartListingIdentity
+			}
+			if !valid || !nativeID {
+				info := multipartUploadInfo(storedBucket, storedObject, uploadUUID, fi.ModTime)
+				if !legacy || info.Initiated.Before(oldest.Initiated) {
+					oldest = info
+				}
+				legacy = true
+			}
+		}
+		if legacy {
+			return oldest, false, true, nil
+		}
+	}
+	readQuorum, _, err := objectQuorumFromMeta(s.ctx, metadata, errs, er.defaultParityCount)
+	if err != nil {
+		return MultipartInfo{}, false, false, err
+	}
+	_, modTime, etag := listOnlineDisks(disks, metadata, errs, readQuorum)
+	if err := reduceReadQuorumErrs(s.ctx, errs, objectOpIgnoredErrs, readQuorum); err != nil {
+		return MultipartInfo{}, false, false, err
+	}
+	fi, err := pickValidFileInfo(s.ctx, metadata, modTime, etag, readQuorum)
+	if err != nil {
+		return MultipartInfo{}, false, false, err
+	}
+	storedBucket, storedObject, valid := er.multipartIdentity(fi, shaDir)
+	info := multipartUploadInfo(storedBucket, storedObject, uploadUUID, fi.ModTime)
+	if storedBucket == "" || storedObject == "" {
+		return info, false, true, nil
+	}
+	if !valid {
+		return MultipartInfo{}, false, false, fmt.Errorf("%w: %s", errMultipartListingIdentity, candidate)
+	}
+	if _, ok := multipartUploadTime(uploadUUID); !ok {
+		return info, false, true, nil
+	}
+	if bucket != "" && bucket != storedBucket {
+		return MultipartInfo{}, false, false, nil
+	}
+	return info, true, false, nil
+}
+
+func (er erasureObjects) scanMultipartUploads(s *multipartScan, bucket string, poolIdx, setIdx int) ([]MultipartInfo, bool, error) {
+	disks := er.getDisks()
+	report := multipartScanSet{Pool: poolIdx, Set: setIdx, Drives: er.setDriveCount}
+	var resultErr error
+	defer func() {
+		if resultErr != nil {
+			report.Error = resultErr.Error()
+		}
+		s.sets = append(s.sets, report)
+	}()
+	var candidateMu sync.Mutex
+	candidates := make(map[string]StorageAPI)
+	errs := make([]error, len(disks))
+	var wg sync.WaitGroup
+	for i, disk := range disks {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			if disk == nil || !disk.IsOnline() {
+				errs[i] = errDiskNotFound
+				return
+			}
+			paths, err := s.listUploadDirs(disk, bucket)
+			errs[i] = err
+			if err != nil {
+				return
+			}
+			candidateMu.Lock()
+			defer candidateMu.Unlock()
+			for _, p := range paths {
+				candidates[p] = disk
+			}
+		}()
+	}
+	wg.Wait()
+	for i, err := range errs {
+		if err == nil {
+			report.ScannedDrives++
+		} else {
+			report.UncoveredDrives = append(report.UncoveredDrives, i)
+			if _, limited := err.(SlowDown); limited {
+				resultErr = err
+			}
+		}
+	}
+	report.Candidates = len(candidates)
+	// A successful scan must intersect every metadata read quorum, including
+	// records left with R copies by a partially failed cancellation.
+	if report.ScannedDrives < er.setDriveCount/2+1 && resultErr == nil {
+		resultErr = toObjectErr(errErasureReadQuorum, bucket)
+	}
+	if resultErr != nil {
+		return nil, false, resultErr
+	}
+	type candidate struct {
+		path   string
+		source StorageAPI
+	}
+	jobs := make(chan candidate)
+	var mu sync.Mutex
+	var uploads []MultipartInfo
+	for range min(16, len(candidates)) {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for c := range jobs {
+				mu.Lock()
+				stopped := resultErr != nil
+				mu.Unlock()
+				if stopped || s.ctx.Err() != nil {
+					continue
+				}
+				upload, found, legacy, err := er.readMultipartUploadCandidate(s, bucket, c.path, c.source)
+				if errors.Is(err, errFileNotFound) || errors.Is(err, errFileVersionNotFound) {
+					continue
+				}
+				mu.Lock()
+				switch {
+				case err != nil && resultErr == nil:
+					resultErr = err
+				case legacy:
+					report.LegacyUploads++
+					if report.OldestLegacy.IsZero() || upload.Initiated.Before(report.OldestLegacy) {
+						report.OldestLegacy = upload.Initiated
+					}
+				case found && !s.preflight:
+					uploads = append(uploads, upload)
+				}
+				mu.Unlock()
+			}
+		}()
+	}
+dispatch:
+	for p, source := range candidates {
+		select {
+		case jobs <- candidate{p, source}:
+		case <-s.ctx.Done():
+			break dispatch
+		}
+	}
+	close(jobs)
+	wg.Wait()
+	if s.ctx.Err() != nil {
+		resultErr = SlowDown{}
+	}
+	return uploads, report.LegacyUploads != 0, resultErr
+}
+
+// multipartPreflight scans all pools, sets and drives, independent of caches.
+// A majority suffices for normal listing; upgrade readiness requires every
+// drive to have been inspected. The operator must also upgrade all writers.
+func (z *erasureServerPools) multipartPreflight(ctx context.Context) (multipartPreflightReport, error) {
+	s, err := startMultipartScan(ctx, true)
+	if err != nil {
+		return multipartPreflightReport{}, err
+	}
+	defer s.close()
+	report := multipartPreflightReport{Complete: true, Mode: "strict"}
+	if globalAPIConfig.getMultipartListingLegacy() {
+		report.Mode = "legacy"
+	}
+	for p, pool := range z.serverPools {
+		for i, set := range pool.sets {
+			_, _, _ = set.scanMultipartUploads(s, "", p, i)
+		}
+	}
+	report.Sets = s.sets
+	for _, set := range s.sets {
+		report.LegacyUploads += set.LegacyUploads
+		if set.Error != "" || set.ScannedDrives != set.Drives {
+			report.Complete = false
+		}
+	}
+	report.ScannedEntries = multipartScanEntryLimit - s.remaining.Load()
+	report.Ready = report.Complete && report.LegacyUploads == 0
+	return report, nil
+}
+
+// MultipartPreflightHandler is a read-only storage-admin diagnostic. It never
+// accepts an arbitrary deletion path or changes upload lifetime settings.
+func (a adminAPIHandlers) MultipartPreflightHandler(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	obj, _ := validateAdminReq(ctx, w, r, policy.StorageInfoAdminAction)
+	if obj == nil {
+		return
+	}
+	z, ok := obj.(*erasureServerPools)
+	if !ok {
+		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrNotImplemented), r.URL)
+		return
+	}
+	report, err := z.multipartPreflight(ctx)
+	if err != nil {
+		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
+		return
+	}
+	b, err := json.Marshal(report)
+	if err != nil {
+		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
+		return
+	}
+	writeSuccessResponseJSON(w, b)
+}
@@ -0,0 +1,796 @@
+// Copyright (c) 2026 Ruohang Feng
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+package cmd
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/minio/minio/internal/config/storageclass"
+)
+
+// Check the real handler and storage path, including a successful abort between
+// pages. Choose IDs increasing in both initiation time and lexical order so the
+// failure does not depend on differing interpretations of S3 marker ordering.
+func TestMultipartListingAbortBetweenHTTPPages(t *testing.T) {
+	z, _ := consistencyPools(t)
+	bucket, router, err := initAPIHandlerTest(t.Context(), z, []string{"ListMultipartUploads", "AbortMultipart"}, MakeBucketOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var firstID, secondID string
+	for attempt := 0; attempt < 32; attempt++ {
+		one, err := z.NewMultipartUpload(t.Context(), bucket, "a", ObjectOptions{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		two, err := z.NewMultipartUpload(t.Context(), bucket, "a", ObjectOptions{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if one.UploadID < two.UploadID {
+			firstID, secondID = one.UploadID, two.UploadID
+			break
+		}
+		for _, id := range []string{one.UploadID, two.UploadID} {
+			if err := z.AbortMultipartUpload(t.Context(), bucket, "a", id, ObjectOptions{}); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	if firstID == "" {
+		t.Fatal("could not construct increasing upload IDs")
+	}
+	if _, err := z.NewMultipartUpload(t.Context(), bucket, "b", ObjectOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	request := func(method, u string) *httptest.ResponseRecorder {
+		t.Helper()
+		req, err := newTestSignedRequestV4(method, u, 0, nil, globalActiveCred.AccessKey, globalActiveCred.SecretKey, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		rec := httptest.NewRecorder()
+		router.ServeHTTP(rec, req)
+		return rec
+	}
+	list := func(keyMarker, uploadMarker string, limit int) ListMultipartUploadsResponse {
+		t.Helper()
+		rec := request(http.MethodGet, getListMultipartUploadsURLWithParams("", bucket, "", keyMarker, uploadMarker, "", strconv.Itoa(limit)))
+		if rec.Code != http.StatusOK {
+			t.Fatalf("list HTTP %d: %s", rec.Code, rec.Body.String())
+		}
+		var result ListMultipartUploadsResponse
+		if err := xml.Unmarshal(rec.Body.Bytes(), &result); err != nil {
+			t.Fatal(err)
+		}
+		return result
+	}
+	first := list("", "", 1)
+	if len(first.Uploads) != 1 || first.Uploads[0].UploadID != firstID || !first.IsTruncated {
+		t.Fatalf("unexpected first page: %+v", first)
+	}
+	rec := request(http.MethodDelete, getAbortMultipartUploadURL("", bucket, "a", firstID))
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("abort HTTP %d: %s", rec.Code, rec.Body.String())
+	}
+	rest := list(first.NextKeyMarker, first.NextUploadIDMarker, 10)
+	var keys []string
+	for _, upload := range rest.Uploads {
+		keys = append(keys, upload.Key)
+	}
+	t.Logf("GET first page=200; DELETE marker=204; GET next page=200 keys=%v truncated=%v", keys, rest.IsTruncated)
+	if _, err := z.GetMultipartInfo(t.Context(), bucket, "a", secondID, ObjectOptions{}); err != nil {
+		t.Fatalf("remaining upload is not valid: %v", err)
+	}
+	if len(rest.Uploads) != 2 || rest.Uploads[0].UploadID != secondID {
+		t.Fatalf("valid remaining upload for key a is missing from continuation: %+v", rest.Uploads)
+	}
+}
+
+type multipartListingFaultDisk struct {
+	StorageAPI
+	read   func(context.Context, string, string, string, string, ReadOptions) (FileInfo, error)
+	delete func(context.Context, string, string, DeleteOptions) error
+}
+
+func (d multipartListingFaultDisk) ReadVersion(ctx context.Context, original, volume, object, version string, opts ReadOptions) (FileInfo, error) {
+	if d.read != nil {
+		return d.read(ctx, original, volume, object, version, opts)
+	}
+	return d.StorageAPI.ReadVersion(ctx, original, volume, object, version, opts)
+}
+
+func (d multipartListingFaultDisk) Delete(ctx context.Context, volume, object string, opts DeleteOptions) error {
+	if d.delete != nil {
+		return d.delete(ctx, volume, object, opts)
+	}
+	return d.StorageAPI.Delete(ctx, volume, object, opts)
+}
+
+func TestMultipartListingLegacyPreflight(t *testing.T) {
+	z, set, bucket := multipartListingFixture(t)
+	const other = "multipart-legacy-other"
+	if err := z.MakeBucket(t.Context(), other, MakeBucketOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	old, err := z.NewMultipartUpload(t.Context(), other, "old", ObjectOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	fi, metadata, err := set.checkUploadIDExists(t.Context(), other, "old", old.UploadID, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i := range metadata {
+		delete(metadata[i].Metadata, multipartMetaBucket)
+		delete(metadata[i].Metadata, multipartMetaObject)
+	}
+	if _, err = writeAllMetadata(t.Context(), set.getDisks(), other, minioMetaMultipartBucket,
+		set.getUploadIDDir(other, "old", old.UploadID), metadata, fi.WriteQuorum(set.defaultWQuorum())); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = z.NewMultipartUpload(t.Context(), bucket, "a", ObjectOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	z.mpCache.Clear()
+	_, err = z.ListMultipartUploads(t.Context(), bucket, "", "", "", "", 10)
+	if !errors.Is(err, errMultipartListingLegacy) {
+		t.Fatalf("old upload in another bucket: %v", err)
+	}
+	report, err := z.multipartPreflight(t.Context())
+	if err != nil || report.Ready || !report.Complete || report.LegacyUploads != 1 {
+		t.Fatalf("legacy preflight: %+v %v", report, err)
+	}
+	if err = z.AbortMultipartUpload(t.Context(), other, "old", old.UploadID, ObjectOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	report, err = z.multipartPreflight(t.Context())
+	if err != nil || !report.Ready || report.LegacyUploads != 0 {
+		t.Fatalf("drained preflight: %+v %v", report, err)
+	}
+	got, err := z.ListMultipartUploads(t.Context(), bucket, "", "", "", "", 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	requireMultipartUploadKeys(t, got, "a")
+}
+
+func TestMultipartListingIdentityFallback(t *testing.T) {
+	for _, kind := range []string{"old", "corrupt", "read-failure", "wrong-bucket"} {
+		t.Run(kind, func(t *testing.T) {
+			z, set, bucket := multipartListingFixture(t)
+			if _, err := z.NewMultipartUpload(t.Context(), bucket, "a", ObjectOptions{}); err != nil {
+				t.Fatal(err)
+			}
+			original := set.getDisks
+			t.Cleanup(func() { set.getDisks = original })
+			var first atomic.Bool
+			set.getDisks = func() []StorageAPI {
+				disks := append([]StorageAPI(nil), original()...)
+				for i, d := range disks {
+					disks[i] = multipartListingFaultDisk{StorageAPI: d, read: func(ctx context.Context, b, v, p, version string, opts ReadOptions) (FileInfo, error) {
+						fi, err := d.ReadVersion(ctx, b, v, p, version, opts)
+						if v == minioMetaMultipartBucket && first.CompareAndSwap(false, true) {
+							if kind == "read-failure" {
+								return FileInfo{}, errDiskNotFound
+							}
+							if kind == "corrupt" {
+								return FileInfo{}, errFileCorrupt
+							}
+							fi.Metadata = cloneMSS(fi.Metadata)
+							if kind == "old" {
+								delete(fi.Metadata, multipartMetaBucket)
+							} else {
+								fi.Metadata[multipartMetaBucket] = "another-bucket"
+							}
+						}
+						return fi, err
+					}}
+				}
+				return disks
+			}
+			got, err := z.ListMultipartUploads(t.Context(), bucket, "", "", "", "", 10)
+			if err != nil {
+				t.Fatal(err)
+			}
+			requireMultipartUploadKeys(t, got, "a")
+		})
+	}
+}
+
+func TestMultipartAbortPoolsAndRetry(t *testing.T) {
+	z, bucket := consistencyPools(t)
+	mp, err := z.serverPools[1].NewMultipartUpload(t.Context(), bucket, "a", ObjectOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	emptySet := z.serverPools[0].getHashedSet("a")
+	original := emptySet.getDisks
+	t.Cleanup(func() { emptySet.getDisks = original })
+	emptySet.getDisks = func() []StorageAPI {
+		disks := append([]StorageAPI(nil), original()...)
+		for i, d := range disks {
+			disks[i] = multipartListingFaultDisk{StorageAPI: d, read: func(context.Context, string, string, string, string, ReadOptions) (FileInfo, error) {
+				return FileInfo{}, errDiskNotFound
+			}}
+		}
+		return disks
+	}
+	err = z.AbortMultipartUpload(t.Context(), bucket, "a", mp.UploadID, ObjectOptions{})
+	if err == nil || toAPIError(t.Context(), err).HTTPStatusCode != 503 {
+		t.Fatalf("unknown pool must not acknowledge cancellation: %v", err)
+	}
+	emptySet.getDisks = original
+	err = z.AbortMultipartUpload(t.Context(), bucket, "a", mp.UploadID, ObjectOptions{})
+	if _, ok := err.(InvalidUploadID); !ok {
+		t.Fatalf("retry after all pools confirm absence: %v", err)
+	}
+	mp, err = z.serverPools[1].NewMultipartUpload(t.Context(), bucket, "a", ObjectOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = z.AbortMultipartUpload(t.Context(), bucket, "a", mp.UploadID, ObjectOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = z.serverPools[1].GetMultipartInfo(t.Context(), bucket, "a", mp.UploadID, ObjectOptions{}); err == nil {
+		t.Fatal("empty first pool hid the actual upload")
+	}
+}
+
+func TestMultipartAbortRetryBelowReadQuorum(t *testing.T) {
+	z, set, bucket := multipartListingFixture(t)
+	mp, err := z.NewMultipartUpload(t.Context(), bucket, "a", ObjectOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	original := set.getDisks
+	t.Cleanup(func() { set.getDisks = original })
+	set.getDisks = func() []StorageAPI {
+		disks := append([]StorageAPI(nil), original()...)
+		disks[3] = nil
+		d := disks[2]
+		disks[2] = multipartListingFaultDisk{StorageAPI: d, delete: func(ctx context.Context, v, p string, opts DeleteOptions) error {
+			if err := d.Delete(ctx, v, p, opts); err != nil {
+				return err
+			}
+			return context.DeadlineExceeded // operation finished, acknowledgement lost
+		}}
+		return disks
+	}
+	if err = z.AbortMultipartUpload(t.Context(), bucket, "a", mp.UploadID, ObjectOptions{}); err == nil {
+		t.Fatal("lost acknowledgement must fail")
+	}
+	set.getDisks = original
+	if err = z.AbortMultipartUpload(t.Context(), bucket, "a", mp.UploadID, ObjectOptions{}); err != nil {
+		t.Fatalf("one remaining metadata copy prevented retry: %v", err)
+	}
+}
+
+func TestMultipartListingMarkerHTTP(t *testing.T) {
+	z, _ := consistencyPools(t)
+	bucket, router, err := initAPIHandlerTest(t.Context(), z, []string{"ListMultipartUploads"}, MakeBucketOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		key, marker string
+		status      int
+	}{
+		{"", "not-base64=", 200},
+		{"a", "not-base64=", 404},
+		{"a", base64.RawURLEncoding.EncodeToString([]byte("not-native")), 400},
+		{"a", multipartListingTestID(time.Unix(100, 0), 1), 200},
+	} {
+		u := getListMultipartUploadsURLWithParams("", bucket, "", tc.key, tc.marker, "", "10")
+		req, err := newTestSignedRequestV4(http.MethodGet, u, 0, nil, globalActiveCred.AccessKey, globalActiveCred.SecretKey, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		rec := httptest.NewRecorder()
+		router.ServeHTTP(rec, req)
+		if rec.Code != tc.status {
+			t.Fatalf("key=%q marker=%q: %d %s", tc.key, tc.marker, rec.Code, rec.Body.String())
+		}
+	}
+}
+
+func TestMultipartPreflightAdminHTTP(t *testing.T) {
+	bed, err := prepareAdminErasureTestBed(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { bed.done(); bed.objLayer.Shutdown(context.Background()); removeRoots(bed.erasureDirs) })
+	const target = "/minio/admin/v3/multipart-preflight"
+	rec := httptest.NewRecorder()
+	bed.router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, target, nil))
+	if rec.Code != 403 {
+		t.Fatalf("anonymous preflight: %d", rec.Code)
+	}
+	req, err := newTestSignedRequestV4(http.MethodGet, target, 0, nil, globalActiveCred.AccessKey, globalActiveCred.SecretKey, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rec = httptest.NewRecorder()
+	bed.router.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("admin preflight: %d %s", rec.Code, rec.Body.String())
+	}
+	var report multipartPreflightReport
+	if err = json.Unmarshal(rec.Body.Bytes(), &report); err != nil || !report.Ready || !report.Complete {
+		t.Fatalf("preflight: %+v %v", report, err)
+	}
+	for range cap(multipartScanSlots) {
+		scan, err := startMultipartScan(t.Context(), false)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer scan.close()
+	}
+	rec = httptest.NewRecorder()
+	bed.router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("busy admin preflight: %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+type multipartLateCreateDisk struct {
+	StorageAPI
+	late chan<- func() error
+}
+
+func (d multipartLateCreateDisk) WriteMetadata(_ context.Context, original, volume, object string, fi FileInfo) error {
+	if volume == minioMetaMultipartBucket {
+		d.late <- func() error { return d.StorageAPI.WriteMetadata(context.Background(), original, volume, object, fi) }
+		return context.DeadlineExceeded
+	}
+	return d.StorageAPI.WriteMetadata(context.Background(), original, volume, object, fi)
+}
+
+// This characterization is deliberately NOT an assertion of terminal abort
+// correctness. It preserves an executable example of the separately scoped
+// late-creation-write limitation. Change the expectation when fencing is added.
+func TestMultipartAbortLateCreateBoundary(t *testing.T) {
+	obj, dirs, err := prepareErasure(t.Context(), 16)
+	if err != nil {
+		t.Fatal(err)
+	}
+	z := obj.(*erasureServerPools)
+	t.Cleanup(func() { z.Shutdown(context.Background()); removeRoots(dirs) })
+	saved := globalStorageClass
+	globalStorageClass.Update(storageclass.Config{Standard: storageclass.StorageClass{Parity: 8}})
+	t.Cleanup(func() { globalStorageClass.Update(saved) })
+	const bucket = "multipart-late-create"
+	if err = z.MakeBucket(t.Context(), bucket, MakeBucketOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	set := z.serverPools[0].getHashedSet("a")
+	original := set.getDisks
+	t.Cleanup(func() { set.getDisks = original })
+	late := make(chan func() error, 16)
+	set.getDisks = func() []StorageAPI {
+		disks := append([]StorageAPI(nil), original()...)
+		for i := 9; i < 16; i++ {
+			disks[i] = multipartLateCreateDisk{disks[i], late}
+		}
+		return disks
+	}
+	mp, err := z.NewMultipartUpload(t.Context(), bucket, "a", ObjectOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(late) != 7 {
+		t.Fatalf("expected seven timed-out creation writes, got %d", len(late))
+	}
+	set.getDisks = func() []StorageAPI {
+		disks := append([]StorageAPI(nil), original()...)
+		for i := 2; i < 9; i++ {
+			disks[i] = nil
+		}
+		return disks
+	}
+	if err = z.AbortMultipartUpload(t.Context(), bucket, "a", mp.UploadID, ObjectOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	for range 7 {
+		if err = (<-late)(); err != nil {
+			t.Fatal(err)
+		}
+	}
+	set.getDisks = original
+	_, metadata, err := set.checkUploadIDExists(t.Context(), bucket, "a", mp.UploadID, true)
+	if err != nil {
+		t.Fatalf("late creation boundary changed; review and remove the documented limitation: %v", err)
+	}
+	count := 0
+	for _, fi := range metadata {
+		if fi.IsValid() {
+			count++
+		}
+	}
+	if count != 14 {
+		t.Fatalf("expected fourteen resurrected copies, got %d", count)
+	}
+	t.Log("KNOWN UNRESOLVED BOUNDARY: seven delayed creation writes plus seven offline copies restore a writable upload after acknowledged cancellation")
+}
+
+type multipartListingCountingDisk struct {
+	StorageAPI
+	directoryCalls *atomic.Int64
+	metadataCalls  *atomic.Int64
+}
+
+func (d multipartListingCountingDisk) ListDir(ctx context.Context, original, volume, dir string, count int) ([]string, error) {
+	if volume == minioMetaMultipartBucket {
+		d.directoryCalls.Add(1)
+	}
+	return d.StorageAPI.ListDir(ctx, original, volume, dir, count)
+}
+
+func (d multipartListingCountingDisk) ReadVersion(ctx context.Context, original, volume, object, version string, opts ReadOptions) (FileInfo, error) {
+	if volume == minioMetaMultipartBucket {
+		d.metadataCalls.Add(1)
+	}
+	return d.StorageAPI.ReadVersion(ctx, original, volume, object, version, opts)
+}
+
+// Counts storage API calls; this is not a deployment throughput benchmark.
+func TestMultipartListingScanCosts(t *testing.T) {
+	obj, dirs, err := prepareErasure(t.Context(), 4)
+	if err != nil {
+		t.Fatal(err)
+	}
+	z := obj.(*erasureServerPools)
+	t.Cleanup(func() { z.Shutdown(context.Background()); removeRoots(dirs) })
+	const bucket, otherBucket = "r9-scan-target", "r9-scan-unrelated"
+	for _, name := range []string{bucket, otherBucket} {
+		if err := z.MakeBucket(t.Context(), name, MakeBucketOptions{}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := z.NewMultipartUpload(t.Context(), bucket, "dir/target", ObjectOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	var directoryCalls, metadataCalls atomic.Int64
+	for _, pool := range z.serverPools {
+		for _, set := range pool.sets {
+			original := set.getDisks
+			set.getDisks = func() []StorageAPI {
+				disks := original()
+				wrapped := make([]StorageAPI, len(disks))
+				for i, disk := range disks {
+					if disk != nil {
+						wrapped[i] = multipartListingCountingDisk{disk, &directoryCalls, &metadataCalls}
+					}
+				}
+				return wrapped
+			}
+			t.Cleanup(func() { set.getDisks = original })
+		}
+	}
+	measure := func(label string) (int64, int64) {
+		t.Helper()
+		directoryCalls.Store(0)
+		metadataCalls.Store(0)
+		result, err := z.ListMultipartUploads(t.Context(), bucket, "dir/", "", "", "", 1)
+		if err != nil {
+			t.Fatal(err)
+		}
+		requireMultipartUploadKeys(t, result, "dir/target")
+		d, m := directoryCalls.Load(), metadataCalls.Load()
+		t.Logf("%s: max-uploads=1 returned=%d ListDir=%d ReadVersion=%d", label, len(result.Uploads), d, m)
+		return d, m
+	}
+	_, baseline := measure("no unrelated uploads")
+	for n := 0; n < 32; n++ {
+		if _, err := z.NewMultipartUpload(t.Context(), otherBucket, fmt.Sprintf("other/%03d", n), ObjectOptions{}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	_, loaded := measure("32 uploads in another bucket")
+	_, repeated := measure("same query repeated")
+	if loaded != baseline+32 || repeated != loaded {
+		t.Fatalf("unexpected scan accounting: baseline=%d loaded=%d repeated=%d", baseline, loaded, repeated)
+	}
+}
+
+func multipartListingTestID(created time.Time, n int) string {
+	return base64.RawURLEncoding.EncodeToString([]byte(fmt.Sprintf("00000000-0000-4000-8000-000000000000.00000000-0000-4000-8000-%012xx%d", n, created.UnixNano())))
+}
+
+func multipartListingFixture(t *testing.T) (*erasureServerPools, *erasureObjects, string) {
+	t.Helper()
+	obj, dirs, err := prepareErasure(t.Context(), 4)
+	if err != nil {
+		t.Fatal(err)
+	}
+	z := obj.(*erasureServerPools)
+	t.Cleanup(func() { z.Shutdown(context.Background()); removeRoots(dirs) })
+	const bucket = "multipart-listing-test"
+	if err := z.MakeBucket(t.Context(), bucket, MakeBucketOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	return z, z.serverPools[0].getHashedSet("a"), bucket
+}
+
+func TestMultipartListingMissingMarkers(t *testing.T) {
+	base := time.Unix(100, 0)
+	sameTime := []string{multipartListingTestID(base.Add(time.Second), 1), multipartListingTestID(base.Add(time.Second), 2), multipartListingTestID(base.Add(time.Second), 3)}
+	slices.Sort(sameTime)
+	uploads := []MultipartInfo{
+		{Bucket: "bucket", Object: "a", UploadID: multipartListingTestID(base, 1), Initiated: base},
+		{Bucket: "bucket", Object: "a", UploadID: sameTime[1], Initiated: base.Add(time.Second)},
+		{Bucket: "bucket", Object: "b", UploadID: multipartListingTestID(base, 4), Initiated: base},
+	}
+	for _, tc := range []struct {
+		name    string
+		created time.Time
+		id      int
+		want    []string
+	}{
+		{"before", base.Add(-time.Second), 0, []string{"a", "a", "b"}},
+		{"between", base.Add(time.Second / 2), 2, []string{"a", "b"}},
+		{"same-time-before", base.Add(time.Second), 2, []string{"a", "b"}},
+		{"same-time-after", base.Add(time.Second), 4, []string{"b"}},
+		{"after", base.Add(2 * time.Second), 5, []string{"b"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			marker := multipartListingTestID(tc.created, tc.id)
+			if tc.name == "same-time-before" {
+				marker = sameTime[0]
+			}
+			if tc.name == "same-time-after" {
+				marker = sameTime[2]
+			}
+			if err := checkListMultipartArgs(t.Context(), "bucket", "", "a", marker, ""); err != nil {
+				t.Fatal(err)
+			}
+			got := paginateMultipartUploads(uploads, "", "a", marker, "", 10)
+			if !slices.Equal(multipartUploadKeys(got.Uploads), tc.want) {
+				t.Fatalf("got %v want %v", multipartUploadKeys(got.Uploads), tc.want)
+			}
+		})
+	}
+}
+
+func TestMultipartListingAbortRecovery(t *testing.T) {
+	for _, offline := range []int{1, 2} {
+		t.Run(fmt.Sprint(offline), func(t *testing.T) {
+			z, set, bucket := multipartListingFixture(t)
+			mp, err := z.NewMultipartUpload(t.Context(), bucket, "a", ObjectOptions{})
+			if err != nil {
+				t.Fatal(err)
+			}
+			original := set.getDisks
+			t.Cleanup(func() { set.getDisks = original })
+			set.getDisks = func() []StorageAPI {
+				disks := append([]StorageAPI(nil), original()...)
+				for i := 0; i < offline; i++ {
+					disks[i] = nil
+				}
+				return disks
+			}
+			err = z.AbortMultipartUpload(t.Context(), bucket, "a", mp.UploadID, ObjectOptions{})
+			if offline == 1 && err != nil {
+				t.Fatal(err)
+			}
+			if offline == 2 && (err == nil || toAPIError(t.Context(), err).HTTPStatusCode != 503) {
+				t.Fatalf("two offline drives must not acknowledge cancellation: %v", err)
+			}
+			set.getDisks = original
+			if offline == 2 {
+				// Retry a partially completed deletion after the original disks return.
+				if err = z.AbortMultipartUpload(t.Context(), bucket, "a", mp.UploadID, ObjectOptions{}); err != nil {
+					t.Fatal(err)
+				}
+			}
+			got, err := z.ListMultipartUploads(t.Context(), bucket, "", "", "", "", 100)
+			if err != nil || len(got.Uploads) != 0 {
+				t.Fatalf("canceled upload reappeared: %+v %v", got, err)
+			}
+		})
+	}
+}
+
+func TestMultipartListingCoverage(t *testing.T) {
+	z, set, bucket := multipartListingFixture(t)
+	mp, err := z.NewMultipartUpload(t.Context(), bucket, "a", ObjectOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	original := set.getDisks
+	t.Cleanup(func() { set.getDisks = original })
+	disks := original()
+	// Leave a readable two-copy record, simulating a partially failed abort.
+	for _, d := range disks[:2] {
+		if err = d.Delete(t.Context(), minioMetaMultipartBucket, set.getUploadIDDir(bucket, "a", mp.UploadID), DeleteOptions{Recursive: true}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	set.getDisks = func() []StorageAPI { return []StorageAPI{disks[0], disks[1], nil, nil} }
+	_, err = z.ListMultipartUploads(t.Context(), bucket, "", "", "", "", 10)
+	if err == nil || toAPIError(t.Context(), err).HTTPStatusCode != 503 {
+		t.Fatalf("incomplete discovery returned success: %v", err)
+	}
+	set.getDisks = func() []StorageAPI { return []StorageAPI{nil, disks[1], disks[2], disks[3]} }
+	got, err := z.ListMultipartUploads(t.Context(), bucket, "", "", "", "", 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	requireMultipartUploadKeys(t, got, "a")
+	report, err := z.multipartPreflight(t.Context())
+	if err != nil || report.Ready || report.Complete || len(report.Sets[0].UncoveredDrives) != 1 {
+		t.Fatalf("offline upgrade preflight: %+v %v", report, err)
+	}
+}
+
+func TestMultipartListingBudgetAndAdmission(t *testing.T) {
+	_, set, bucket := multipartListingFixture(t)
+	if _, err := set.NewMultipartUpload(t.Context(), bucket, "a", ObjectOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	scan, err := startMultipartScan(t.Context(), false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer scan.close()
+	scan.remaining.Store(1)
+	_, _, err = set.scanMultipartUploads(scan, bucket, 0, 0)
+	var limited SlowDown
+	if !errors.As(err, &limited) {
+		t.Fatalf("budget: %v", err)
+	}
+	if apiErr := toAPIError(t.Context(), err); apiErr.HTTPStatusCode != http.StatusServiceUnavailable || apiErr.Code != "SlowDown" {
+		t.Fatalf("budget error mapping: %+v", apiErr)
+	}
+	second, err := startMultipartScan(t.Context(), false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer second.close()
+	if third, err := startMultipartScan(t.Context(), false); err == nil {
+		third.close()
+		t.Fatal("third scan admitted")
+	}
+}
+
+func TestMultipartListingAdmissionHTTP(t *testing.T) {
+	z, _, _ := multipartListingFixture(t)
+	bucket, router, err := initAPIHandlerTest(t.Context(), z, []string{"ListMultipartUploads"}, MakeBucketOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for range cap(multipartScanSlots) {
+		scan, err := startMultipartScan(t.Context(), false)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer scan.close()
+	}
+	req, err := newTestSignedRequestV4(http.MethodGet,
+		getListMultipartUploadsURLWithParams("", bucket, "", "", "", "", "1"),
+		0, nil, globalActiveCred.AccessKey, globalActiveCred.SecretKey, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	var response APIErrorResponse
+	if err := xml.Unmarshal(rec.Body.Bytes(), &response); err != nil {
+		t.Fatal(err)
+	}
+	if rec.Code != http.StatusServiceUnavailable || response.Code != "SlowDown" {
+		t.Fatalf("admission returned %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestMultipartListingPreflightMinorityLegacy(t *testing.T) {
+	z, set, bucket := multipartListingFixture(t)
+	mp, err := z.NewMultipartUpload(t.Context(), bucket, "old", ObjectOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := set.getUploadIDDir(bucket, "old", mp.UploadID)
+	disks := set.getDisks()
+	fi, err := disks[0].ReadVersion(t.Context(), bucket, minioMetaMultipartBucket, path, "", ReadOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	delete(fi.Metadata, multipartMetaBucket)
+	delete(fi.Metadata, multipartMetaObject)
+	if err = disks[0].WriteMetadata(t.Context(), bucket, minioMetaMultipartBucket, path, fi); err != nil {
+		t.Fatal(err)
+	}
+	for _, d := range disks[1:] {
+		if err = d.Delete(t.Context(), minioMetaMultipartBucket, path, DeleteOptions{Recursive: true}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	report, err := z.multipartPreflight(t.Context())
+	if err != nil || report.Ready || !report.Complete || report.LegacyUploads != 1 {
+		t.Fatalf("minority legacy copy must prevent readiness: %+v %v", report, err)
+	}
+}
+
+func TestMultipartListingCancellationRetainsAdmission(t *testing.T) {
+	z, set, bucket := multipartListingFixture(t)
+	for i := range 40 {
+		if _, err := z.NewMultipartUpload(t.Context(), bucket, fmt.Sprintf("key-%02d", i), ObjectOptions{}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	original := set.getDisks
+	t.Cleanup(func() { set.getDisks = original })
+	entered := make(chan struct{}, 40)
+	release := make(chan struct{})
+	var once sync.Once
+	defer once.Do(func() { close(release) })
+	var reads atomic.Int32
+	set.getDisks = func() []StorageAPI {
+		disks := append([]StorageAPI(nil), original()...)
+		for i, d := range disks {
+			disks[i] = multipartListingFaultDisk{StorageAPI: d, read: func(ctx context.Context, b, v, p, version string, opts ReadOptions) (FileInfo, error) {
+				if v != minioMetaMultipartBucket {
+					return d.ReadVersion(ctx, b, v, p, version, opts)
+				}
+				reads.Add(1)
+				entered <- struct{}{}
+				// Model an RPC which does not return immediately on cancellation.
+				<-release
+				return FileInfo{}, ctx.Err()
+			}}
+		}
+		return disks
+	}
+	second, err := startMultipartScan(t.Context(), false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer second.close()
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	done := make(chan error, 1)
+	go func() {
+		_, err := z.ListMultipartUploads(ctx, bucket, "", "", "", "", 10)
+		done <- err
+	}()
+	for range 16 {
+		select {
+		case <-entered:
+		case <-time.After(5 * time.Second):
+			t.Fatal("identity workers did not start")
+		}
+	}
+	cancel()
+	if extra, err := startMultipartScan(t.Context(), false); err == nil {
+		extra.close()
+		t.Fatal("canceled request released admission while RPCs were still running")
+	}
+	start := time.Now()
+	once.Do(func() { close(release) })
+	select {
+	case err := <-done:
+		if err == nil {
+			t.Fatal("canceled scan returned a successful partial list")
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("scan did not stop after blocked RPCs returned")
+	}
+	if got := reads.Load(); got != 16 {
+		t.Fatalf("scheduled more identity/metadata reads after cancellation: %d", got)
+	}
+	t.Logf("16 identity RPCs bounded; admission held until return; cancellation settled in %s", time.Since(start))
+}
@@ -31,6 +31,7 @@ import (
 	"sync"
 	"time"

+	"github.com/google/uuid"
 	"github.com/klauspost/readahead"
 	"github.com/minio/minio-go/v7/pkg/set"
 	"github.com/minio/minio/internal/config/storageclass"
@@ -44,6 +45,15 @@ import (
 	"github.com/pgsty/silo-pkg/v3/sync/errgroup"
 )

+const (
+	multipartMetaBucket = ReservedMetadataPrefixLower + "multipart-v1-bucket"
+	multipartMetaObject = ReservedMetadataPrefixLower + "multipart-v1-object"
+
+	// ponytail: keep scan concurrency fixed until the multipart-list benchmark
+	// establishes a better adaptive limit.
+	multipartMetadataScanConcurrency = 4
+)
+
 func (er erasureObjects) getUploadIDDir(bucket, object, uploadID string) string {
 	uploadUUID := uploadID
 	uploadBytes, err := base64.RawURLEncoding.DecodeString(uploadID)
@@ -251,14 +261,152 @@ func (er erasureObjects) cleanupStaleUploadsOnDisk(ctx context.Context, disk Sto
 	})
 }

-// ListMultipartUploads - lists all the pending multipart
-// uploads for a particular object in a bucket.
-//
-// Implements minimal S3 compatible ListMultipartUploads API. We do
-// not support prefix based listing, this is a deliberate attempt
-// towards simplification of multipart APIs.
-// The resulting ListMultipartsInfo structure is unmarshalled directly as XML.
-func (er erasureObjects) ListMultipartUploads(ctx context.Context, bucket, object, keyMarker, uploadIDMarker, delimiter string, maxUploads int) (result ListMultipartsInfo, err error) {
+func multipartUploadInfo(bucket, object, uploadUUID string, fallback time.Time) MultipartInfo {
+	initiated := fallback
+	if parsed, ok := multipartUploadTime(uploadUUID); ok {
+		initiated = parsed
+	}
+	return MultipartInfo{
+		Bucket:    bucket,
+		Object:    object,
+		UploadID:  base64.RawURLEncoding.EncodeToString(fmt.Appendf(nil, "%s.%s", globalDeploymentID(), uploadUUID)),
+		Initiated: initiated,
+	}
+}
+
+// multipartUploadTime is shared by stored records and continuation markers.
+// The time is part of the immutable upload ID, so a removed marker still
+// identifies the same ordering boundary.
+func multipartUploadTime(uploadUUID string) (time.Time, bool) {
+	if len(uploadUUID) < 38 || uploadUUID[36] != 'x' {
+		return time.Time{}, false
+	}
+	if _, err := uuid.Parse(uploadUUID[:36]); err != nil {
+		return time.Time{}, false
+	}
+	ns, err := strconv.ParseInt(uploadUUID[37:], 10, 64)
+	if err != nil || ns <= 0 || strconv.FormatInt(ns, 10) != uploadUUID[37:] {
+		return time.Time{}, false
+	}
+	return time.Unix(0, ns), true
+}
+
+func multipartMarkerTime(uploadID string) (time.Time, bool) {
+	b, err := base64.RawURLEncoding.DecodeString(uploadID)
+	if err != nil {
+		return time.Time{}, false
+	}
+	_, uploadUUID, ok := strings.Cut(string(b), ".")
+	if !ok {
+		return time.Time{}, false
+	}
+	return multipartUploadTime(uploadUUID)
+}
+
+type multipartListEntry struct {
+	upload       *MultipartInfo
+	commonPrefix string
+}
+
+// paginateMultipartUploads applies the S3 ordering, prefix, delimiter, marker,
+// and page rules exactly once after all pools and sets have been merged.
+func paginateMultipartUploads(uploads []MultipartInfo, prefix, keyMarker, uploadIDMarker, delimiter string, maxUploads int) ListMultipartsInfo {
+	if maxUploads > maxUploadsList {
+		maxUploads = maxUploadsList
+	}
+	result := ListMultipartsInfo{
+		MaxUploads:     maxUploads,
+		KeyMarker:      keyMarker,
+		UploadIDMarker: uploadIDMarker,
+		Prefix:         prefix,
+		Delimiter:      delimiter,
+	}
+
+	deduplicated := make([]MultipartInfo, 0, len(uploads))
+	seenUploads := make(map[string]struct{}, len(uploads))
+	for _, upload := range uploads {
+		identity := upload.Bucket + "\x00" + upload.Object + "\x00" + upload.UploadID
+		if _, ok := seenUploads[identity]; ok {
+			continue
+		}
+		seenUploads[identity] = struct{}{}
+		deduplicated = append(deduplicated, upload)
+	}
+	sort.Slice(deduplicated, func(i, j int) bool {
+		if deduplicated[i].Object != deduplicated[j].Object {
+			return deduplicated[i].Object < deduplicated[j].Object
+		}
+		if !deduplicated[i].Initiated.Equal(deduplicated[j].Initiated) {
+			return deduplicated[i].Initiated.Before(deduplicated[j].Initiated)
+		}
+		return deduplicated[i].UploadID < deduplicated[j].UploadID
+	})
+
+	markerTime, _ := multipartMarkerTime(uploadIDMarker)
+	seenPrefixes := make(map[string]struct{})
+	entries := make([]multipartListEntry, 0, len(deduplicated))
+	for i := range deduplicated {
+		upload := &deduplicated[i]
+		if !strings.HasPrefix(upload.Object, prefix) {
+			continue
+		}
+		if keyMarker != "" {
+			switch strings.Compare(upload.Object, keyMarker) {
+			case -1:
+				continue
+			case 0:
+				if uploadIDMarker == "" || upload.Initiated.Before(markerTime) ||
+					(upload.Initiated.Equal(markerTime) && upload.UploadID <= uploadIDMarker) {
+					continue
+				}
+			}
+		}
+
+		if delimiter != "" {
+			remainder := strings.TrimPrefix(upload.Object, prefix)
+			if i := strings.Index(remainder, delimiter); i >= 0 {
+				commonPrefix := prefix + remainder[:i+len(delimiter)]
+				if keyMarker != "" && commonPrefix <= keyMarker {
+					continue
+				}
+				if _, ok := seenPrefixes[commonPrefix]; ok {
+					continue
+				}
+				seenPrefixes[commonPrefix] = struct{}{}
+				entries = append(entries, multipartListEntry{commonPrefix: commonPrefix})
+				continue
+			}
+		}
+		entries = append(entries, multipartListEntry{upload: upload})
+	}
+
+	if maxUploads <= 0 {
+		return result
+	}
+	pageSize := min(maxUploads, len(entries))
+	for _, entry := range entries[:pageSize] {
+		if entry.upload != nil {
+			result.Uploads = append(result.Uploads, *entry.upload)
+			continue
+		}
+		result.CommonPrefixes = append(result.CommonPrefixes, entry.commonPrefix)
+	}
+	result.IsTruncated = pageSize < len(entries)
+	if result.IsTruncated && pageSize > 0 {
+		last := entries[pageSize-1]
+		if last.upload != nil {
+			result.NextKeyMarker = last.upload.Object
+			result.NextUploadIDMarker = last.upload.UploadID
+		} else {
+			result.NextKeyMarker = last.commonPrefix
+		}
+	}
+	return result
+}
+
+// listMultipartUploadsExact preserves the hashed exact-object lookup used by
+// multipart write placement and by rolling-upgrade legacy mode.
+func (er erasureObjects) listMultipartUploadsExact(ctx context.Context, bucket, object, keyMarker, uploadIDMarker, delimiter string, maxUploads int) (result ListMultipartsInfo, err error) {
 	auditObjectErasureSet(ctx, "ListMultipartUploads", object, &er)

 	result.MaxUploads = maxUploads
@@ -311,20 +459,16 @@ func (er erasureObjects) ListMultipartUploads(ctx context.Context, bucket, objec
 		if populatedUploadIDs.Contains(uploadID) {
 			continue
 		}
-		// If present, use time stored in ID.
-		startTime := time.Now()
-		if split := strings.Split(uploadID, "x"); len(split) == 2 {
-			t, err := strconv.ParseInt(split[1], 10, 64)
-			if err == nil {
-				startTime = time.Unix(0, t)
+		var fallback time.Time
+		if _, ok := multipartUploadTime(uploadID); !ok {
+			fi, err := disk.ReadVersion(ctx, bucket, minioMetaMultipartBucket,
+				pathJoin(er.getMultipartSHADir(bucket, object), uploadID), "", ReadOptions{})
+			if err != nil {
+				return result, toObjectErr(err, bucket, object)
 			}
+			fallback = fi.ModTime
 		}
-		uploads = append(uploads, MultipartInfo{
-			Bucket:    bucket,
-			Object:    object,
-			UploadID:  base64.RawURLEncoding.EncodeToString(fmt.Appendf(nil, "%s.%s", globalDeploymentID(), uploadID)),
-			Initiated: startTime,
-		})
+		uploads = append(uploads, multipartUploadInfo(bucket, object, uploadID, fallback))
 		populatedUploadIDs.Add(uploadID)
 	}

@@ -365,6 +509,25 @@ func (er erasureObjects) ListMultipartUploads(ctx context.Context, bucket, objec
 	return result, nil
 }

+func (er erasureObjects) ListMultipartUploads(ctx context.Context, bucket, prefix, keyMarker, uploadIDMarker, delimiter string, maxUploads int) (ListMultipartsInfo, error) {
+	if err := checkListMultipartArgs(ctx, bucket, prefix, keyMarker, uploadIDMarker, delimiter); err != nil {
+		return ListMultipartsInfo{}, err
+	}
+	scan, err := startMultipartScan(ctx, false)
+	if err != nil {
+		return ListMultipartsInfo{}, err
+	}
+	defer scan.close()
+	uploads, legacy, err := er.scanMultipartUploads(scan, bucket, 0, 0)
+	if err != nil {
+		return ListMultipartsInfo{}, err
+	}
+	if legacy {
+		return ListMultipartsInfo{}, errMultipartListingLegacy
+	}
+	return paginateMultipartUploads(uploads, prefix, keyMarker, uploadIDMarker, delimiter, maxUploads), nil
+}
+
 // newMultipartUpload - wrapper for initializing a new multipart
 // request; returns a unique upload id.
 //
@@ -402,6 +565,8 @@ func (er erasureObjects) newMultipartUpload(ctx context.Context, bucket string,
 	}

 	userDefined := cloneMSS(opts.UserDefined)
+	userDefined[multipartMetaBucket] = bucket
+	userDefined[multipartMetaObject] = object
 	if opts.PreserveETag != "" {
 		userDefined["etag"] = opts.PreserveETag
 	}
@@ -1459,6 +1624,8 @@ func (er erasureObjects) CompleteMultipartUpload(ctx context.Context, bucket str
 	// Remove superfluous internal headers.
 	delete(fi.Metadata, hash.MinIOMultipartChecksum)
 	delete(fi.Metadata, hash.MinIOMultipartChecksumType)
+	delete(fi.Metadata, multipartMetaBucket)
+	delete(fi.Metadata, multipartMetaObject)

 	// Save the final object size and modtime.
 	fi.Size = objectSize
@@ -1586,22 +1753,66 @@ func (er erasureObjects) CompleteMultipartUpload(ctx context.Context, bucket str
 	return fi.ToObjectInfo(bucket, object, opts.Versioned || opts.VersionSuspended), nil
 }

-// AbortMultipartUpload - aborts an ongoing multipart operation
-// signified by the input uploadID. This is an atomic operation
-// doesn't require clients to initiate multiple such requests.
-//
-// All parts are purged from all disks and reference to the uploadID
-// would be removed from the system, rollback is not possible on this
-// operation.
-func (er erasureObjects) AbortMultipartUpload(ctx context.Context, bucket, object, uploadID string, opts ObjectOptions) (err error) {
+// abortMultipartUpload confirms absence on a strict majority of this set.
+// Unlike an existence read followed by best-effort deletion, it also permits
+// retrying a partial deletion which no longer has a readable metadata quorum.
+// This does not fence creation writes still executing after a storage timeout.
+func (er erasureObjects) abortMultipartUpload(ctx context.Context, bucket, object, uploadID string, opts ObjectOptions) (bool, error) {
 	if !opts.NoAuditLog {
 		auditObjectErasureSet(ctx, "AbortMultipartUpload", object, &er)
 	}
-
-	// Cleanup all uploaded parts.
-	defer er.deleteAll(ctx, minioMetaMultipartBucket, er.getUploadIDDir(bucket, object, uploadID))
-
-	// Validates if upload ID exists.
-	_, _, err = er.checkUploadIDExists(ctx, bucket, object, uploadID, false)
-	return toObjectErr(err, bucket, object, uploadID)
+	b, err := base64.RawURLEncoding.DecodeString(uploadID)
+	if err != nil {
+		return false, MalformedUploadID{UploadID: uploadID}
+	}
+	_, internalID, ok := strings.Cut(string(b), ".")
+	if !ok || internalID == "" || internalID == "." || internalID == ".." || strings.ContainsAny(internalID, "/\\") {
+		return false, InvalidUploadID{Bucket: bucket, Object: object, UploadID: uploadID}
+	}
+	disks := er.getDisks()
+	uploadPath := er.getUploadIDDir(bucket, object, uploadID)
+	_, errs := readAllFileInfo(ctx, disks, bucket, minioMetaMultipartBucket, uploadPath, "", false, false)
+	quorum := er.setDriveCount/2 + 1
+	found, absent := false, 0
+	for _, err := range errs {
+		switch {
+		case err == nil, errors.Is(err, errFileCorrupt):
+			found = true
+		case errors.Is(err, errFileNotFound), errors.Is(err, errFileVersionNotFound):
+			absent++
+		}
+	}
+	if absent >= quorum {
+		return found, nil
+	}
+	if !found {
+		return false, toObjectErr(errErasureReadQuorum, bucket, object, uploadID)
+	}
+	g := errgroup.WithNErrs(len(disks))
+	for i, disk := range disks {
+		g.Go(func() error {
+			if disk == nil {
+				return errDiskNotFound
+			}
+			err := disk.Delete(ctx, minioMetaMultipartBucket, uploadPath, DeleteOptions{Recursive: true, Immediate: false})
+			if errors.Is(err, errFileNotFound) || errors.Is(err, errFileVersionNotFound) {
+				return nil
+			}
+			return err
+		}, i)
+	}
+	return true, toObjectErr(reduceWriteQuorumErrs(ctx, g.Wait(), nil, quorum), bucket, object, uploadID)
+}
+
+// AbortMultipartUpload confirms logical cancellation. Offline part data may
+// still need stale-upload cleanup after its drives return.
+func (er erasureObjects) AbortMultipartUpload(ctx context.Context, bucket, object, uploadID string, opts ObjectOptions) (err error) {
+	found, err := er.abortMultipartUpload(ctx, bucket, object, uploadID, opts)
+	if err != nil {
+		return err
+	}
+	if !found {
+		return InvalidUploadID{Bucket: bucket, Object: object, UploadID: uploadID}
+	}
+	return nil
 }
@@ -2327,7 +2327,11 @@ func (er erasureObjects) PutObjectTags(ctx context.Context, bucket, object strin

 	fi.Metadata[xhttp.AmzObjectTagging] = tags
 	fi.ReplicationState = opts.PutReplicationState()
+	stamp := monotonicTaggingTimestamp(opts.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp], fi.Metadata[ReservedMetadataPrefixLower+TaggingTimestamp])
 	maps.Copy(fi.Metadata, opts.UserDefined)
+	if stamp != "" {
+		fi.Metadata[ReservedMetadataPrefixLower+TaggingTimestamp] = stamp
+	}

 	if err = er.updateObjectMeta(ctx, bucket, object, fi, onlineDisks); err != nil {
 		return ObjectInfo{}, toObjectErr(err, bucket, object)
@@ -242,6 +242,21 @@ func reconcileStoredObjectTags(metadata map[string]string, storedTags, storedTim
 	}
 }

+// Local tagging mutations must advance the revision they overwrite, even when
+// a request's clock or lock acquisition order is behind the stored revision.
+// Replica writes use reconcileStoredObjectTags instead of minting a revision.
+func monotonicTaggingTimestamp(incoming, stored string) string {
+	requested, err := time.Parse(time.RFC3339Nano, incoming)
+	if err != nil {
+		return incoming
+	}
+	current, err := time.Parse(time.RFC3339Nano, stored)
+	if err != nil || requested.After(current) {
+		return incoming
+	}
+	return current.Add(time.Nanosecond).UTC().Format(time.RFC3339Nano)
+}
+
 // A restored version still owns its tier reference even while IsRemote is
 // false. Only the last copy of a reference may schedule its contents for GC.
 func sharesTierObject(oi ObjectInfo, copies []PoolObjInfo) bool {
@@ -0,0 +1,721 @@
+// Copyright (c) 2026 Feng Ruohang
+//
+// This file is part of Silo Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"crypto/md5"
+	"encoding/base64"
+	"fmt"
+	"maps"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	xhttp "github.com/minio/minio/internal/http"
+	"github.com/minio/minio/internal/kms"
+)
+
+// Change allocation capacity only; metadata and data use real fixture disks.
+// Restoring the adapters also lets encrypted fixtures move the write target
+// between requests without changing the production allocation policy.
+type conditionalPutCapacityDisk struct {
+	StorageAPI
+	full bool
+}
+
+func (d conditionalPutCapacityDisk) DiskInfo(ctx context.Context, opts DiskInfoOptions) (DiskInfo, error) {
+	info, err := d.StorageAPI.DiskInfo(ctx, opts)
+	info.Total, info.Used = 1<<40, 0
+	if d.full {
+		info.Used = info.Total - (1 << 20)
+	}
+	info.Free = info.Total - info.Used
+	return info, err
+}
+
+// Keep getDisks immutable while background IAM and storage readers use it.
+// GetDisks takes this same mutex when it copies the backing disk list.
+func conditionalPutSwapDisks(pool *erasureSets, object string, wrap func(StorageAPI) StorageAPI) func() {
+	setIndex := pool.getHashedSet(object).setIndex
+	pool.erasureDisksMu.Lock()
+	previous := pool.erasureDisks[setIndex]
+	disks := append([]StorageAPI(nil), previous...)
+	for i, disk := range disks {
+		disks[i] = wrap(disk)
+	}
+	pool.erasureDisks[setIndex] = disks
+	pool.erasureDisksMu.Unlock()
+	return func() {
+		pool.erasureDisksMu.Lock()
+		pool.erasureDisks[setIndex] = previous
+		pool.erasureDisksMu.Unlock()
+	}
+}
+
+func conditionalPutPool(t *testing.T, z *erasureServerPools, object string, target int) func() {
+	t.Helper()
+	var restore []func()
+	for i, pool := range z.serverPools {
+		restore = append(restore, conditionalPutSwapDisks(pool, object, func(disk StorageAPI) StorageAPI {
+			return conditionalPutCapacityDisk{StorageAPI: disk, full: i != target}
+		}))
+	}
+	return func() {
+		for _, fn := range restore {
+			fn()
+		}
+	}
+}
+
+func conditionalPutBucket(t *testing.T, z *erasureServerPools, mode string) (string, http.Handler) {
+	t.Helper()
+	bucket, router, err := initAPIHandlerTest(t.Context(), z, nil, MakeBucketOptions{VersioningEnabled: mode != "unversioned"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if mode == "suspended" {
+		if _, err := globalBucketMetadataSys.Update(t.Context(), bucket, bucketVersioningConfig,
+			[]byte(`<VersioningConfiguration><Status>Suspended</Status></VersioningConfiguration>`)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return bucket, router
+}
+
+func TestPoolsConditionalPutHTTP(t *testing.T) {
+	for _, mode := range []string{"unversioned", "versioned", "suspended"} {
+		t.Run(mode, func(t *testing.T) {
+			z, _ := consistencyPools(t)
+			bucket, router := conditionalPutBucket(t, z, mode)
+			for target := range 2 {
+				for _, tc := range []struct {
+					name                  string
+					oldCopy, localCurrent bool
+					condition             string
+					status                int
+				}{
+					{"stale-etag-accepted", true, false, "old", http.StatusPreconditionFailed},
+					{"current-etag-rejected", true, false, "current", http.StatusOK},
+					{"create-only-overwrites-other-pool", false, false, "none", http.StatusPreconditionFailed},
+					{"current-etag-missing-in-write-pool", false, false, "current", http.StatusOK},
+					{"control-current-in-write-pool", true, true, "current", http.StatusOK},
+					{"control-stale-etag-rejected", true, true, "old", http.StatusPreconditionFailed},
+					{"none-match-current-etag", true, false, "none-current", http.StatusPreconditionFailed},
+					{"none-match-old-etag", true, false, "none-old", http.StatusOK},
+				} {
+					t.Run(fmt.Sprintf("target=%d/%s", target, tc.name), func(t *testing.T) {
+						object := fmt.Sprintf("%d-%s", target, tc.name)
+						currentPool := 1 - target
+						if tc.localCurrent {
+							currentPool = target
+						}
+						opts := ObjectOptions{Versioned: mode == "versioned", VersionSuspended: mode == "suspended", MTime: UTCNow().Add(-time.Hour)}
+						oldETag := "absent-old"
+						if tc.oldCopy {
+							oldETag = putConsistencyObject(t, z, bucket, object, 1-currentPool, "old", opts).ETag
+						}
+						opts.MTime = UTCNow().Add(-time.Minute)
+						current := putConsistencyObject(t, z, bucket, object, currentPool, "current", opts)
+						defer conditionalPutPool(t, z, object, target)()
+						idx, err := z.getWritePoolIdx(t.Context(), bucket, object, 11, false)
+						if err != nil || idx != target {
+							t.Fatalf("allocation target=%d: idx=%d err=%v", target, idx, err)
+						}
+						headers := map[string]string{xhttp.IfMatch: fmt.Sprintf("%q", current.ETag)}
+						if tc.condition == "old" {
+							headers[xhttp.IfMatch] = fmt.Sprintf("%q", oldETag)
+						}
+						if tc.condition == "none" {
+							headers = map[string]string{xhttp.IfNoneMatch: "*"}
+						}
+						if tc.condition == "none-current" {
+							headers = map[string]string{xhttp.IfNoneMatch: fmt.Sprintf("%q", current.ETag)}
+						}
+						if tc.condition == "none-old" {
+							headers = map[string]string{xhttp.IfNoneMatch: fmt.Sprintf("%q", oldETag)}
+						}
+						url := getPutObjectURL("", bucket, object)
+						before := multipartConditionRequest(t, router, http.MethodGet, url, "", nil)
+						if before.Code != http.StatusOK || before.Body.String() != "current" || multipartConditionResponseETag(before) != current.ETag {
+							t.Fatalf("invalid current object: %d %q %v", before.Code, before.Body.String(), before.Header())
+						}
+						put := multipartConditionRequest(t, router, http.MethodPut, url, "replacement", headers)
+						if put.Code != tc.status {
+							t.Errorf("PUT status=%d want=%d: %s", put.Code, tc.status, put.Body.String())
+						}
+						if put.Code == http.StatusPreconditionFailed {
+							multipartConditionError(t, put, "PreconditionFailed")
+							if multipartConditionResponseETag(put) != current.ETag || put.Header().Get(xhttp.LastModified) != before.Header().Get(xhttp.LastModified) {
+								t.Errorf("412 headers do not describe current object: %v", put.Header())
+							}
+						}
+						get := multipartConditionRequest(t, router, http.MethodGet, url, "", nil)
+						wantBody, wantETag := "current", current.ETag
+						if tc.status == http.StatusOK {
+							wantBody, wantETag = "replacement", fmt.Sprintf("%x", md5.Sum([]byte("replacement")))
+						}
+						t.Logf("PUT %d; GET %d bytes=%q ETag=%s", put.Code, get.Code, get.Body.String(), multipartConditionResponseETag(get))
+						if get.Code != http.StatusOK || get.Body.String() != wantBody || multipartConditionResponseETag(get) != wantETag {
+							t.Errorf("GET=%d bytes=%q ETag=%s; want %q %s", get.Code, get.Body.String(), multipartConditionResponseETag(get), wantBody, wantETag)
+						}
+					})
+				}
+			}
+		})
+	}
+}
+
+func TestPoolsConditionalPutHTTPAbsence(t *testing.T) {
+	for _, state := range []string{"missing", "uuid-marker", "null-marker"} {
+		for _, match := range []bool{false, true} {
+			t.Run(fmt.Sprintf("%s/match=%t", state, match), func(t *testing.T) {
+				z, _ := consistencyPools(t)
+				mode := "versioned"
+				if state == "null-marker" {
+					mode = "suspended"
+				}
+				bucket, router := conditionalPutBucket(t, z, mode)
+				object := "absent-key"
+				if state != "missing" {
+					putConsistencyObject(t, z, bucket, object, 0, "old", ObjectOptions{Versioned: true, MTime: UTCNow().Add(-time.Hour)})
+					vid := mustGetUUID()
+					if state == "null-marker" {
+						vid = nullVersionID
+					}
+					if _, err := z.serverPools[1].DeleteObject(t.Context(), bucket, object, ObjectOptions{Versioned: true, VersionID: vid, DeleteMarker: true, MTime: UTCNow().Add(-time.Minute)}); err != nil {
+						t.Fatal(err)
+					}
+				}
+				defer conditionalPutPool(t, z, object, 0)()
+				headers := map[string]string{xhttp.IfNoneMatch: "*"}
+				want := http.StatusOK
+				if match {
+					headers = map[string]string{xhttp.IfMatch: "*"}
+					want = http.StatusNotFound
+				}
+				url := getPutObjectURL("", bucket, object)
+				put := multipartConditionRequest(t, router, http.MethodPut, url, "new", headers)
+				if put.Code != want {
+					t.Fatalf("PUT %d want %d: %s", put.Code, want, put.Body.String())
+				}
+				get := multipartConditionRequest(t, router, http.MethodGet, url, "", nil)
+				if match {
+					multipartConditionError(t, put, "NoSuchKey")
+					if get.Code != http.StatusNotFound {
+						t.Fatalf("failed PUT exposed data: %d %s", get.Code, get.Body.String())
+					}
+				} else if get.Code != http.StatusOK || get.Body.String() != "new" || multipartConditionResponseETag(get) != multipartConditionResponseETag(put) {
+					t.Fatalf("successful create GET: %d %q %v", get.Code, get.Body.String(), get.Header())
+				}
+			})
+		}
+	}
+}
+
+func TestPoolsConditionalPutUnreadable(t *testing.T) {
+	for faultPool := range 2 {
+		for _, present := range []bool{false, true} {
+			for _, match := range []bool{false, true} {
+				t.Run(fmt.Sprintf("fault-pool=%d/present=%t/match=%t", faultPool, present, match), func(t *testing.T) {
+					z, _ := consistencyPools(t)
+					bucket, router := conditionalPutBucket(t, z, "unversioned")
+					object := "unreadable-key"
+					if present {
+						putConsistencyObject(t, z, bucket, object, 0, "old", ObjectOptions{MTime: UTCNow().Add(-time.Hour)})
+						putConsistencyObject(t, z, bucket, object, 1, "current", ObjectOptions{MTime: UTCNow().Add(-time.Minute)})
+					}
+					defer conditionalPutPool(t, z, object, 0)()
+					restoreFault := conditionalPutSwapDisks(z.serverPools[faultPool], object, func(disk StorageAPI) StorageAPI {
+						return consistencyReadFaultDisk{StorageAPI: disk, bucket: bucket, object: object}
+					})
+					defer restoreFault()
+					headers := map[string]string{xhttp.IfNoneMatch: "*"}
+					if match {
+						headers = map[string]string{xhttp.IfMatch: "*"}
+					}
+					url := getPutObjectURL("", bucket, object)
+					put := multipartConditionRequest(t, router, http.MethodPut, url, "replacement", headers)
+					if put.Code != http.StatusServiceUnavailable {
+						t.Errorf("unverified PUT must fail: %d %s", put.Code, put.Body.String())
+					}
+					called := 0
+					_, err := z.PutObject(t.Context(), bucket, object, mustGetPutObjReader(t, strings.NewReader("replacement"), 11, "", ""), ObjectOptions{HasIfMatch: match, CheckPrecondFn: func(ObjectInfo) bool { called++; return false }})
+					if !isErrReadQuorum(err) || called != 0 {
+						t.Errorf("lookup error=%v callback calls=%d", err, called)
+					}
+					restoreFault()
+					get := multipartConditionRequest(t, router, http.MethodGet, url, "", nil)
+					if present {
+						if get.Code != http.StatusOK || get.Body.String() != "current" || multipartConditionResponseETag(get) != fmt.Sprintf("%x", md5.Sum([]byte("current"))) {
+							t.Fatalf("failed PUT changed object: %d %q", get.Code, get.Body.String())
+						}
+					} else if get.Code != http.StatusNotFound {
+						t.Fatalf("failed PUT created object: %d %q", get.Code, get.Body.String())
+					}
+				})
+			}
+		}
+	}
+}
+
+func TestPoolsConditionalPutEncryptedETag(t *testing.T) {
+	for _, kind := range []string{"SSE-C", "SSE-S3", "SSE-KMS"} {
+		t.Run(kind, func(t *testing.T) {
+			z, _ := consistencyPools(t)
+			bucket, router := conditionalPutBucket(t, z, "unversioned")
+			oldKMS, oldTLS := GlobalKMS, globalIsTLS
+			GlobalKMS, globalIsTLS = kms.NewStub("conditional-put-key"), true
+			defer func() { GlobalKMS, globalIsTLS = oldKMS, oldTLS }()
+			headers := map[string]string{xhttp.AmzServerSideEncryption: xhttp.AmzEncryptionAES}
+			readHeaders := map[string]string{}
+			if kind == "SSE-C" {
+				key := bytes.Repeat([]byte{0x42}, 32)
+				digest := md5.Sum(key)
+				headers = map[string]string{
+					xhttp.AmzServerSideEncryptionCustomerAlgorithm: xhttp.AmzEncryptionAES,
+					xhttp.AmzServerSideEncryptionCustomerKey:       base64.StdEncoding.EncodeToString(key),
+					xhttp.AmzServerSideEncryptionCustomerKeyMD5:    base64.StdEncoding.EncodeToString(digest[:]),
+				}
+				readHeaders = maps.Clone(headers)
+			}
+			if kind == "SSE-KMS" {
+				headers[xhttp.AmzServerSideEncryption] = xhttp.AmzEncryptionKMS
+				headers[xhttp.AmzServerSideEncryptionKmsID] = "conditional-put-key"
+			}
+			object := "encrypted-key"
+			url := getPutObjectURL("", bucket, object)
+			restore := conditionalPutPool(t, z, object, 0)
+			old := multipartConditionRequest(t, router, http.MethodPut, url, "old", headers)
+			restore()
+			restore = conditionalPutPool(t, z, object, 1)
+			current := multipartConditionRequest(t, router, http.MethodPut, url, "current", headers)
+			restore()
+			if old.Code != http.StatusOK || current.Code != http.StatusOK {
+				t.Fatalf("encrypted setup: %d %s / %d %s", old.Code, old.Body.String(), current.Code, current.Body.String())
+			}
+			defer conditionalPutPool(t, z, object, 0)()
+			for _, stale := range []bool{true, false} {
+				h := maps.Clone(headers)
+				h[xhttp.IfMatch] = fmt.Sprintf("%q", multipartConditionResponseETag(current))
+				wantStatus, wantBody, wantETag := http.StatusOK, "replacement", ""
+				if stale {
+					h[xhttp.IfMatch] = fmt.Sprintf("%q", multipartConditionResponseETag(old))
+					wantStatus, wantBody, wantETag = http.StatusPreconditionFailed, "current", multipartConditionResponseETag(current)
+				}
+				put := multipartConditionRequest(t, router, http.MethodPut, url, "replacement", h)
+				if put.Code != wantStatus {
+					t.Fatalf("encrypted condition: %d want %d: %s", put.Code, wantStatus, put.Body.String())
+				}
+				if !stale {
+					wantETag = multipartConditionResponseETag(put)
+				}
+				get := multipartConditionRequest(t, router, http.MethodGet, url, "", readHeaders)
+				if get.Code != http.StatusOK || get.Body.String() != wantBody || multipartConditionResponseETag(get) != wantETag {
+					t.Fatalf("encrypted GET: %d %q %v", get.Code, get.Body.String(), get.Header())
+				}
+			}
+		})
+	}
+}
+
+func TestPoolsConditionalPutVersionSelection(t *testing.T) {
+	for _, kind := range []string{"public-version", "replica", "replica-preserve-etag", "movement", "no-lock", "tie", "draining"} {
+		t.Run(kind, func(t *testing.T) {
+			z, bucket := consistencyPools(t)
+			object := "version-selection"
+			addressed := putConsistencyObject(t, z, bucket, object, 1, "addressed", ObjectOptions{Versioned: true, MTime: UTCNow().Add(-time.Hour)})
+			current := putConsistencyObject(t, z, bucket, object, 1, "current", ObjectOptions{Versioned: true, MTime: UTCNow().Add(-time.Minute)})
+			opts := ObjectOptions{Versioned: true, VersionID: addressed.VersionID, HasIfMatch: true}
+			want := current
+			switch kind {
+			case "replica":
+				opts.ReplicaLockReconcile, opts.ReplicationRequest = true, true
+				want = addressed
+			case "replica-preserve-etag":
+				opts.PreserveETag = addressed.ETag
+				opts.ReplicaLockReconcile, opts.ReplicationRequest = true, true
+				want = addressed
+			case "movement":
+				opts.DataMovement, opts.SrcPoolIdx = true, 1
+				want = addressed
+			case "tie":
+				want = putConsistencyObject(t, z, bucket, object, 0, "tie-winner", ObjectOptions{Versioned: true, MTime: current.ModTime})
+			case "draining":
+				z.poolMetaMutex.Lock()
+				z.poolMeta.Pools[1].Decommission = &PoolDecommissionInfo{}
+				z.poolMetaMutex.Unlock()
+			}
+			defer conditionalPutPool(t, z, object, 0)()
+			ctx := t.Context()
+			if kind == "no-lock" {
+				lk := z.NewNSLock(bucket, object)
+				lkctx, err := lk.GetLock(ctx, globalOperationTimeout)
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer lk.Unlock(lkctx)
+				ctx, opts.NoLock = lkctx.Context(), true
+			}
+			called := 0
+			opts.UserDefined = make(map[string]string)
+			opts.CheckPrecondFn = func(oi ObjectInfo) bool {
+				called++
+				if oi.ETag != want.ETag || oi.VersionID != want.VersionID {
+					t.Errorf("comparison ETag/version=%s/%s want %s/%s", oi.ETag, oi.VersionID, want.ETag, want.VersionID)
+				}
+				return oi.ETag != want.ETag
+			}
+			oi, err := z.PutObject(ctx, bucket, object, mustGetPutObjReader(t, strings.NewReader("replacement"), 11, "", ""), opts)
+			if err != nil || called != 1 {
+				t.Fatalf("PUT err=%v callback calls=%d", err, called)
+			}
+			if oi.VersionID != addressed.VersionID {
+				t.Fatalf("destination version changed: %s", oi.VersionID)
+			}
+			if opts.PreserveETag != "" && oi.ETag != opts.PreserveETag {
+				t.Fatalf("PreserveETag changed: %s", oi.ETag)
+			}
+		})
+	}
+}
+
+func TestPoolsConditionalPutReplicaDuplicateHTTP(t *testing.T) {
+	for _, null := range []bool{false, true} {
+		t.Run(fmt.Sprintf("null=%t", null), func(t *testing.T) {
+			z, _ := consistencyPools(t)
+			bucket, router := conditionalPutBucket(t, z, "versioned")
+			object := "replica-duplicate"
+			vid := mustGetUUID()
+			if null {
+				vid = nullVersionID
+			}
+			addressed := putConsistencyObject(t, z, bucket, object, 1, "addressed", ObjectOptions{Versioned: true, VersionID: vid, MTime: UTCNow().Add(-time.Hour)})
+			current := putConsistencyObject(t, z, bucket, object, 1, "current", ObjectOptions{Versioned: true, MTime: UTCNow().Add(-time.Minute)})
+			defer conditionalPutPool(t, z, object, 0)()
+			headers := map[string]string{
+				xhttp.MinIOSourceReplicationRequest: "true",
+				xhttp.AmzBucketReplicationStatus:    "REPLICA",
+				xhttp.MinIOSourceETag:               addressed.ETag,
+				xhttp.MinIOSourceMTime:              addressed.ModTime.Format(time.RFC3339Nano),
+			}
+			url := getPutObjectURL("", bucket, object)
+			put := multipartConditionRequest(t, router, http.MethodPut, url+"?versionId="+vid, "addressed", headers)
+			if put.Code != http.StatusPreconditionFailed {
+				t.Fatalf("replica duplicate: %d %s", put.Code, put.Body.String())
+			}
+			multipartConditionError(t, put, "PreconditionFailed")
+			get := multipartConditionRequest(t, router, http.MethodGet, url, "", nil)
+			if get.Code != http.StatusOK || get.Body.String() != "current" || multipartConditionResponseETag(get) != current.ETag {
+				t.Fatalf("duplicate changed current object: %d %q", get.Code, get.Body.String())
+			}
+			get = multipartConditionRequest(t, router, http.MethodGet, url+"?versionId="+vid, "", nil)
+			if get.Code != http.StatusOK || get.Body.String() != "addressed" || multipartConditionResponseETag(get) != addressed.ETag {
+				t.Fatalf("duplicate changed addressed version: %d %q", get.Code, get.Body.String())
+			}
+		})
+	}
+}
+
+func TestPoolsConditionalPutConcurrentHTTP(t *testing.T) {
+	z, _ := consistencyPools(t)
+	bucket, router := conditionalPutBucket(t, z, "unversioned")
+	for _, match := range []bool{false, true} {
+		for iteration := range 5 {
+			t.Run(fmt.Sprintf("match=%t/iteration=%d", match, iteration), func(t *testing.T) {
+				object := fmt.Sprintf("concurrent-%t-%d", match, iteration)
+				headers := map[string]string{xhttp.IfNoneMatch: "*"}
+				if match {
+					oi := putConsistencyObject(t, z, bucket, object, 1, "old", ObjectOptions{MTime: UTCNow().Add(-time.Minute)})
+					headers = map[string]string{xhttp.IfMatch: fmt.Sprintf("%q", oi.ETag)}
+				}
+				defer conditionalPutPool(t, z, object, 0)()
+				start := make(chan struct{})
+				results := make(chan *httptest.ResponseRecorder, 2)
+				url := getPutObjectURL("", bucket, object)
+				for i := range 2 {
+					body := fmt.Sprintf("writer-%d", i)
+					req, err := newTestSignedRequestV4(http.MethodPut, url, int64(len(body)), strings.NewReader(body), globalActiveCred.AccessKey, globalActiveCred.SecretKey, headers)
+					if err != nil {
+						t.Fatal(err)
+					}
+					go func() {
+						<-start
+						rec := httptest.NewRecorder()
+						router.ServeHTTP(rec, req)
+						results <- rec
+					}()
+				}
+				close(start)
+				success, failed, winnerETag := 0, 0, ""
+				for range 2 {
+					result := <-results
+					switch result.Code {
+					case http.StatusOK:
+						success++
+						winnerETag = multipartConditionResponseETag(result)
+					case http.StatusPreconditionFailed:
+						failed++
+						multipartConditionError(t, result, "PreconditionFailed")
+					default:
+						t.Errorf("unexpected PUT %d: %s", result.Code, result.Body.String())
+					}
+				}
+				if success != 1 || failed != 1 {
+					t.Fatalf("success=%d precondition failures=%d", success, failed)
+				}
+				get := multipartConditionRequest(t, router, http.MethodGet, url, "", nil)
+				if get.Code != http.StatusOK || multipartConditionResponseETag(get) != winnerETag || fmt.Sprintf("%x", md5.Sum(get.Body.Bytes())) != winnerETag {
+					t.Fatalf("winner lost: %d %q %v", get.Code, get.Body.String(), get.Header())
+				}
+			})
+		}
+	}
+}
+
+func TestPoolsConditionalPutSerializesMutation(t *testing.T) {
+	for _, deletion := range []bool{false, true} {
+		t.Run(fmt.Sprintf("delete=%t", deletion), func(t *testing.T) {
+			z, bucket := consistencyPools(t)
+			object := "conditional-mutation"
+			current := putConsistencyObject(t, z, bucket, object, 1, "current", ObjectOptions{MTime: UTCNow().Add(-time.Minute)})
+			defer conditionalPutPool(t, z, object, 0)()
+			ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+			defer cancel()
+			gate := &consistencyGateReader{Reader: strings.NewReader("replacement"), entered: make(chan struct{}), resume: make(chan struct{})}
+			release := func() { gate.release.Do(func() { close(gate.resume) }) }
+			defer release()
+			reader := mustGetPutObjReader(t, gate, 11, "", "")
+			written := make(chan error, 1)
+			go func() {
+				_, err := z.PutObject(ctx, bucket, object, reader, ObjectOptions{HasIfMatch: true, CheckPrecondFn: func(oi ObjectInfo) bool { return oi.ETag != current.ETag }})
+				written <- err
+			}()
+			select {
+			case <-gate.entered:
+			case err := <-written:
+				t.Fatalf("PUT failed before body read: %v", err)
+			case <-ctx.Done():
+				t.Fatal(ctx.Err())
+			}
+			mutated := make(chan error, 1)
+			go func() {
+				var err error
+				if deletion {
+					_, err = z.DeleteObject(ctx, bucket, object, ObjectOptions{})
+				} else {
+					_, err = z.PutObjectMetadata(ctx, bucket, object, ObjectOptions{EvalMetadataFn: func(oi *ObjectInfo, _ error) (ReplicateDecision, error) {
+						oi.UserDefined["x-amz-meta-after-put"] = "present"
+						return ReplicateDecision{}, nil
+					}})
+				}
+				mutated <- err
+			}()
+			select {
+			case err := <-mutated:
+				t.Fatalf("mutation escaped PUT lock: %v", err)
+			case <-time.After(100 * time.Millisecond):
+			}
+			release()
+			if err := <-written; err != nil {
+				t.Fatal(err)
+			}
+			if err := <-mutated; err != nil {
+				t.Fatal(err)
+			}
+			oi, err := z.GetObjectInfo(ctx, bucket, object, ObjectOptions{})
+			if deletion {
+				if !isErrObjectNotFound(err) {
+					t.Fatalf("delete lost: %v", err)
+				}
+			} else if err != nil || oi.UserDefined["x-amz-meta-after-put"] != "present" || oi.ETag != fmt.Sprintf("%x", md5.Sum([]byte("replacement"))) {
+				t.Fatalf("metadata/PUT lost: %+v %v", oi, err)
+			}
+		})
+	}
+}
+
+func TestSinglePoolConditionalPutHTTP(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	obj, dirs, err := prepareErasure16(ctx)
+	if err != nil {
+		cancel()
+		t.Fatal(err)
+	}
+	z := obj.(*erasureServerPools)
+	t.Cleanup(func() { cancel(); z.Shutdown(context.Background()); removeRoots(dirs) })
+	if !z.SinglePool() {
+		t.Fatal("fixture is not a single pool")
+	}
+	bucket, router := conditionalPutBucket(t, z, "unversioned")
+	object := "single-pool-condition"
+	defer conditionalPutPool(t, z, object, 0)()
+	url := getPutObjectURL("", bucket, object)
+	for _, tc := range []struct {
+		body, match, none string
+		status            int
+	}{
+		{"missing", "*", "", http.StatusNotFound},
+		{"first", "", "*", http.StatusOK},
+		{"blocked", "", "*", http.StatusPreconditionFailed},
+		{"blocked", "stale", "", http.StatusPreconditionFailed},
+		{"second", fmt.Sprintf("%x", md5.Sum([]byte("first"))), "", http.StatusOK},
+	} {
+		rec := multipartConditionRequest(t, router, http.MethodPut, url, tc.body, map[string]string{xhttp.IfMatch: tc.match, xhttp.IfNoneMatch: tc.none})
+		if rec.Code != tc.status {
+			t.Fatalf("PUT %d want %d: %s", rec.Code, tc.status, rec.Body.String())
+		}
+	}
+	get := multipartConditionRequest(t, router, http.MethodGet, url, "", nil)
+	if get.Code != http.StatusOK || get.Body.String() != "second" {
+		t.Fatalf("single-pool GET: %d %q", get.Code, get.Body.String())
+	}
+}
+
+// An internal replica callback without an addressed version is not a public
+// condition. Preserve its availability when another pool is unreadable. An
+// addressed replica already requires all pools for lock/tag reconciliation.
+func TestPoolsConditionalPutReplicaAvailability(t *testing.T) {
+	for _, addressed := range []bool{false, true} {
+		t.Run(fmt.Sprintf("addressed=%t", addressed), func(t *testing.T) {
+			z, _ := consistencyPools(t)
+			mode := "unversioned"
+			if addressed {
+				mode = "versioned"
+			}
+			bucket, router := conditionalPutBucket(t, z, mode)
+			object := "replica-availability"
+			oi := putConsistencyObject(t, z, bucket, object, 0, "old", ObjectOptions{Versioned: addressed, MTime: UTCNow().Add(-time.Minute)})
+			defer conditionalPutPool(t, z, object, 0)()
+			restoreFault := conditionalPutSwapDisks(z.serverPools[1], object, func(disk StorageAPI) StorageAPI {
+				return consistencyReadFaultDisk{StorageAPI: disk, bucket: bucket, object: object}
+			})
+			defer restoreFault()
+			headers := map[string]string{
+				xhttp.MinIOSourceReplicationRequest: "true",
+				xhttp.AmzBucketReplicationStatus:    "REPLICA",
+				xhttp.MinIOSourceETag:               fmt.Sprintf("%x", md5.Sum([]byte("replacement"))),
+			}
+			url := getPutObjectURL("", bucket, object)
+			wantStatus, wantBody := http.StatusOK, "replacement"
+			if addressed {
+				url += "?versionId=" + oi.VersionID
+				wantStatus, wantBody = http.StatusServiceUnavailable, "old"
+			}
+			put := multipartConditionRequest(t, router, http.MethodPut, url, "replacement", headers)
+			if put.Code != wantStatus {
+				t.Fatalf("replica PUT: %d want %d: %s", put.Code, wantStatus, put.Body.String())
+			}
+			restoreFault()
+			get := multipartConditionRequest(t, router, http.MethodGet, url, "", nil)
+			if get.Code != http.StatusOK || get.Body.String() != wantBody {
+				t.Fatalf("replica GET: %d %q", get.Code, get.Body.String())
+			}
+		})
+	}
+}
+
+func TestPoolsConditionalPutDestinationVersionHTTP(t *testing.T) {
+	z, _ := consistencyPools(t)
+	bucket, router := conditionalPutBucket(t, z, "versioned")
+	object := "client-version"
+	old := putConsistencyObject(t, z, bucket, object, 0, "old", ObjectOptions{Versioned: true, MTime: UTCNow().Add(-time.Hour)})
+	current := putConsistencyObject(t, z, bucket, object, 1, "current", ObjectOptions{Versioned: true, MTime: UTCNow().Add(-time.Minute)})
+	defer conditionalPutPool(t, z, object, 0)()
+	url := getPutObjectURL("", bucket, object) + "?versionId=" + old.VersionID
+	for _, stale := range []bool{true, false} {
+		tag, status := current.ETag, http.StatusOK
+		if stale {
+			tag, status = old.ETag, http.StatusPreconditionFailed
+		}
+		put := multipartConditionRequest(t, router, http.MethodPut, url, "replacement", map[string]string{xhttp.IfMatch: fmt.Sprintf("%q", tag)})
+		if put.Code != status {
+			t.Fatalf("version-addressed public PUT: %d want %d: %s", put.Code, status, put.Body.String())
+		}
+		if got := put.Header()[xhttp.AmzVersionID]; !stale && (len(got) != 1 || got[0] != old.VersionID) {
+			t.Fatalf("write version changed: %v", put.Header())
+		}
+	}
+	get := multipartConditionRequest(t, router, http.MethodGet, url, "", nil)
+	if get.Code != http.StatusOK || get.Body.String() != "replacement" {
+		t.Fatalf("addressed GET: %d %q", get.Code, get.Body.String())
+	}
+}
+
+func TestPoolsConditionalPutDeleteMarkerTie(t *testing.T) {
+	for markerPool := range 2 {
+		t.Run(fmt.Sprintf("marker-pool=%d", markerPool), func(t *testing.T) {
+			z, _ := consistencyPools(t)
+			bucket, router := conditionalPutBucket(t, z, "versioned")
+			object := "marker-tie"
+			mtime := UTCNow().Add(-time.Minute)
+			putConsistencyObject(t, z, bucket, object, 1-markerPool, "live", ObjectOptions{Versioned: true, MTime: mtime})
+			if _, err := z.serverPools[markerPool].DeleteObject(t.Context(), bucket, object, ObjectOptions{Versioned: true, VersionID: mustGetUUID(), DeleteMarker: true, MTime: mtime}); err != nil {
+				t.Fatal(err)
+			}
+			defer conditionalPutPool(t, z, object, 0)()
+			url := getPutObjectURL("", bucket, object)
+			before := multipartConditionRequest(t, router, http.MethodGet, url, "", nil)
+			want := http.StatusPreconditionFailed
+			if markerPool == 0 {
+				want = http.StatusOK
+				if before.Code != http.StatusNotFound {
+					t.Fatalf("GET tie: %d", before.Code)
+				}
+			} else if before.Code != http.StatusOK {
+				t.Fatalf("GET tie: %d", before.Code)
+			}
+			put := multipartConditionRequest(t, router, http.MethodPut, url, "replacement", map[string]string{xhttp.IfNoneMatch: "*"})
+			if put.Code != want {
+				t.Fatalf("PUT tie: %d want %d: %s", put.Code, want, put.Body.String())
+			}
+		})
+	}
+}
+
+// Overlap fixture changes with the real IAM Walk reader instead of relying on
+// its periodic refresh timer to expose an unsynchronized disk-adapter swap.
+func TestPoolsConditionalPutFixtureConcurrentIAM(t *testing.T) {
+	z, _ := consistencyPools(t)
+	conditionalPutBucket(t, z, "unversioned")
+	ctx, cancel := context.WithTimeout(t.Context(), 30*time.Second)
+	defer cancel()
+	started, finished := make(chan struct{}), make(chan error, 1)
+	iam := globalIAMSys
+	go func() {
+		close(started)
+		for range 20 {
+			if err := iam.Load(ctx, false); err != nil {
+				finished <- err
+				return
+			}
+		}
+		finished <- nil
+	}()
+	<-started
+	for i := range 5000 {
+		restore := conditionalPutPool(t, z, "fixture-concurrent-iam", i%2)
+		restore()
+	}
+	if err := <-finished; err != nil {
+		t.Fatal(err)
+	}
+}
@@ -1149,6 +1149,40 @@ func (z *erasureServerPools) PutObject(ctx context.Context, bucket string, objec
 	}
 	opts.NoLock = true

+	// Public write conditions compare the logical current object while the
+	// pools-layer write lock is held. The destination selected by capacity may
+	// be empty or stale, and draining pools can still hold the current object.
+	// Replica callbacks retain their existing addressed-version semantics and
+	// metadata reconciliation at the set layer.
+	if opts.CheckPrecondFn != nil && !opts.ReplicationRequest &&
+		!opts.ReplicaLockReconcile && !opts.DataMovement {
+		copies, lerr := z.objectPoolInfos(ctx, bucket, object, ObjectOptions{
+			VersionID:        "", // Compare the current object, not the write's version.
+			Versioned:        opts.Versioned,
+			VersionSuspended: opts.VersionSuspended,
+			NoAuditLog:       true,
+		})
+		var latest ObjectInfo
+		if lerr == nil {
+			latest = copies[0].ObjInfo
+			if latest.DeleteMarker {
+				lerr = toObjectErr(errFileNotFound, bucket, object)
+			}
+		}
+		// An unreadable pool may hold the newest object; it is not absence.
+		if lerr != nil && !isErrObjectNotFound(lerr) && !isErrVersionNotFound(lerr) {
+			return ObjectInfo{}, lerr
+		}
+		if lerr == nil && opts.CheckPrecondFn(latest) {
+			return ObjectInfo{}, PreConditionFailed{}
+		}
+		if lerr != nil && opts.HasIfMatch {
+			return ObjectInfo{}, lerr
+		}
+		// Do not repeat an accepted condition against the destination's copy.
+		opts.CheckPrecondFn = nil
+	}
+
 	idx, err := z.getWritePoolIdx(ctx, bucket, object, data.Size(), true)
 	if err != nil {
 		return ObjectInfo{}, err
@@ -1857,7 +1891,41 @@ func (z *erasureServerPools) ListMultipartUploads(ctx context.Context, bucket, p
 	if err := checkListMultipartArgs(ctx, bucket, prefix, keyMarker, uploadIDMarker, delimiter); err != nil {
 		return ListMultipartsInfo{}, err
 	}
+	if _, err := z.GetBucketInfo(ctx, bucket, BucketOptions{}); err != nil {
+		return ListMultipartsInfo{}, toObjectErr(err, bucket)
+	}
+	if globalAPIConfig.getMultipartListingLegacy() {
+		return z.listMultipartUploadsLegacy(ctx, bucket, prefix, keyMarker, uploadIDMarker, delimiter, maxUploads)
+	}
+	scan, err := startMultipartScan(ctx, false)
+	if err != nil {
+		return ListMultipartsInfo{}, err
+	}
+	defer scan.close()

+	var uploads []MultipartInfo
+	var keyless bool
+	for idx, pool := range z.serverPools {
+		if z.IsSuspended(idx) {
+			continue
+		}
+		poolUploads, poolKeyless, err := pool.scanMultipartUploads(scan, bucket, idx)
+		if err != nil {
+			return ListMultipartsInfo{}, err
+		}
+		uploads = append(uploads, poolUploads...)
+		keyless = keyless || poolKeyless
+	}
+
+	// The old format cannot be enumerated authoritatively. Migration mode is
+	// explicit: another bucket must never silently change this API's semantics.
+	if keyless {
+		return ListMultipartsInfo{}, errMultipartListingLegacy
+	}
+	return paginateMultipartUploads(uploads, prefix, keyMarker, uploadIDMarker, delimiter, maxUploads), nil
+}
+
+func (z *erasureServerPools) listMultipartUploadsLegacy(ctx context.Context, bucket, prefix, keyMarker, uploadIDMarker, delimiter string, maxUploads int) (ListMultipartsInfo, error) {
 	poolResult := ListMultipartsInfo{}
 	poolResult.MaxUploads = maxUploads
 	poolResult.KeyMarker = keyMarker
@@ -1883,15 +1951,14 @@ func (z *erasureServerPools) ListMultipartUploads(ctx context.Context, bucket, p
 	}

 	if z.SinglePool() {
-		return z.serverPools[0].ListMultipartUploads(ctx, bucket, prefix, keyMarker, uploadIDMarker, delimiter, maxUploads)
+		return z.serverPools[0].getHashedSet(prefix).listMultipartUploadsExact(ctx, bucket, prefix, keyMarker, uploadIDMarker, delimiter, maxUploads)
 	}

 	for idx, pool := range z.serverPools {
 		if z.IsSuspended(idx) {
 			continue
 		}
-		result, err := pool.ListMultipartUploads(ctx, bucket, prefix, keyMarker, uploadIDMarker,
-			delimiter, maxUploads)
+		result, err := pool.getHashedSet(prefix).listMultipartUploadsExact(ctx, bucket, prefix, keyMarker, uploadIDMarker, delimiter, maxUploads)
 		if err != nil {
 			return result, err
 		}
@@ -1927,7 +1994,7 @@ func (z *erasureServerPools) NewMultipartUpload(ctx context.Context, bucket, obj
 			continue
 		}

-		result, err := pool.ListMultipartUploads(ctx, bucket, object, "", "", "", maxUploadsList)
+		result, err := pool.listMultipartUploadsExact(ctx, bucket, object)
 		if err != nil {
 			return nil, err
 		}
@@ -2089,9 +2156,13 @@ func (z *erasureServerPools) AbortMultipartUpload(ctx context.Context, bucket, o
 	if err := checkAbortMultipartArgs(ctx, bucket, object, uploadID); err != nil {
 		return err
 	}
+	if _, err := z.GetBucketInfo(ctx, bucket, BucketOptions{}); err != nil {
+		return toObjectErr(err, bucket)
+	}

 	defer func() {
-		if err == nil {
+		_, absent := err.(InvalidUploadID)
+		if err == nil || absent {
 			z.mpCache.Delete(uploadID)
 			globalNotificationSys.DeleteUploadID(ctx, uploadID)
 		}
@@ -2105,23 +2176,23 @@ func (z *erasureServerPools) AbortMultipartUpload(ctx context.Context, bucket, o
 	ctx = lkctx.Context()
 	defer lk.Unlock(lkctx)

-	if z.SinglePool() {
-		return z.serverPools[0].AbortMultipartUpload(ctx, bucket, object, uploadID, opts)
-	}
-
+	found := false
+	var firstErr error
 	for idx, pool := range z.serverPools {
 		if z.IsSuspended(idx) {
 			continue
 		}
-		err := pool.AbortMultipartUpload(ctx, bucket, object, uploadID, opts)
-		if err == nil {
-			return nil
+		poolFound, err := pool.getHashedSet(object).abortMultipartUpload(ctx, bucket, object, uploadID, opts)
+		found = found || poolFound
+		if err != nil && firstErr == nil {
+			firstErr = err
 		}
-		if _, ok := err.(InvalidUploadID); ok {
-			// upload id not found move to next pool
-			continue
-		}
-		return err
+	}
+	if firstErr != nil {
+		return firstErr
+	}
+	if found {
+		return nil
 	}
 	return InvalidUploadID{
 		Bucket:   bucket,
@@ -3051,6 +3122,15 @@ func (z *erasureServerPools) PutObjectTags(ctx context.Context, bucket, object s
 	if err != nil {
 		return ObjectInfo{}, err
 	}
+	// Ordinary reads and replication can return any owning pool. Persist one
+	// revision beyond all copies, so the returned value and every pool agree.
+	if stamp := opts.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp]; stamp != "" {
+		for _, copy := range copies {
+			stamp = monotonicTaggingTimestamp(stamp, copy.ObjInfo.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp])
+		}
+		opts.UserDefined = cloneMSS(opts.UserDefined)
+		opts.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp] = stamp
+	}
 	opts.NoLock = true
 	opts.VersionID = copies[0].ObjInfo.VersionID
 	if opts.VersionID == "" {
@@ -880,10 +880,40 @@ func (s *erasureSets) CopyObject(ctx context.Context, srcBucket, srcObject, dstB
 }

 func (s *erasureSets) ListMultipartUploads(ctx context.Context, bucket, prefix, keyMarker, uploadIDMarker, delimiter string, maxUploads int) (result ListMultipartsInfo, err error) {
-	// In list multipart uploads we are going to treat input prefix as the object,
-	// this means that we are not supporting directory navigation.
-	set := s.getHashedSet(prefix)
-	return set.ListMultipartUploads(ctx, bucket, prefix, keyMarker, uploadIDMarker, delimiter, maxUploads)
+	if err := checkListMultipartArgs(ctx, bucket, prefix, keyMarker, uploadIDMarker, delimiter); err != nil {
+		return ListMultipartsInfo{}, err
+	}
+	scan, err := startMultipartScan(ctx, false)
+	if err != nil {
+		return ListMultipartsInfo{}, err
+	}
+	defer scan.close()
+	uploads, legacy, err := s.scanMultipartUploads(scan, bucket, 0)
+	if err != nil {
+		return ListMultipartsInfo{}, err
+	}
+	if legacy {
+		return ListMultipartsInfo{}, errMultipartListingLegacy
+	}
+	return paginateMultipartUploads(uploads, prefix, keyMarker, uploadIDMarker, delimiter, maxUploads), nil
+}
+
+func (s *erasureSets) scanMultipartUploads(scan *multipartScan, bucket string, poolIdx int) ([]MultipartInfo, bool, error) {
+	var uploads []MultipartInfo
+	var keyless bool
+	for i, set := range s.sets {
+		setUploads, setKeyless, err := set.scanMultipartUploads(scan, bucket, poolIdx, i)
+		if err != nil {
+			return nil, false, err
+		}
+		uploads = append(uploads, setUploads...)
+		keyless = keyless || setKeyless
+	}
+	return uploads, keyless, nil
+}
+
+func (s *erasureSets) listMultipartUploadsExact(ctx context.Context, bucket, object string) (ListMultipartsInfo, error) {
+	return s.getHashedSet(object).listMultipartUploadsExact(ctx, bucket, object, "", "", "", maxUploadsList)
 }

 // Initiate a new multipart upload on a hashedSet based on object name.
@@ -50,6 +50,7 @@ type apiConfig struct {
 	transitionWorkers      int

 	staleUploadsExpiry          time.Duration
+	multipartListingLegacy      bool
 	staleUploadsCleanupInterval time.Duration
 	deleteCleanupInterval       time.Duration
 	enableODirect               bool
@@ -181,6 +182,7 @@ func (t *apiConfig) init(cfg api.Config, setDriveCounts []int, legacy bool) {
 	t.transitionWorkers = cfg.TransitionWorkers

 	t.staleUploadsExpiry = cfg.StaleUploadsExpiry
+	t.multipartListingLegacy = cfg.MultipartListing == "legacy"
 	t.deleteCleanupInterval = cfg.DeleteCleanupInterval
 	t.enableODirect = cfg.EnableODirect
 	t.gzipObjects = cfg.GzipObjects
@@ -206,6 +208,12 @@ func (t *apiConfig) odirectEnabled() bool {
 	return t.enableODirect
 }

+func (t *apiConfig) getMultipartListingLegacy() bool {
+	t.mu.RLock()
+	defer t.mu.RUnlock()
+	return t.multipartListingLegacy
+}
+
 func (t *apiConfig) shouldGzipObjects() bool {
 	t.mu.RLock()
 	defer t.mu.RUnlock()
@@ -0,0 +1,298 @@
+// Copyright (c) 2026 mr javad seydi
+//
+// This file is part of Silo Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cmd
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"slices"
+	"testing"
+	"time"
+)
+
+func multipartUploadKeys(uploads []MultipartInfo) []string {
+	keys := make([]string, len(uploads))
+	for i := range uploads {
+		keys[i] = uploads[i].Object
+	}
+	return keys
+}
+
+func requireMultipartUploadKeys(t *testing.T, got ListMultipartsInfo, want ...string) {
+	t.Helper()
+	if keys := multipartUploadKeys(got.Uploads); !slices.Equal(keys, want) {
+		t.Fatalf("uploads = %v, want %v", keys, want)
+	}
+}
+
+func TestListMultipartUploadsS3Compatibility(t *testing.T) {
+	obj, dirs, err := prepareErasureSets32(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	z := obj.(*erasureServerPools)
+	t.Cleanup(func() {
+		z.Shutdown(t.Context())
+		removeRoots(dirs)
+	})
+
+	const bucket = "multipart-list-compat"
+	if err = z.MakeBucket(t.Context(), bucket, MakeBucketOptions{}); err != nil {
+		t.Fatal(err)
+	}
+
+	objects := []string{"t/a_b/p1", "t/a_b/p2", "t/c_d/p1", "u/x"}
+	sets := z.serverPools[0]
+	firstSet := sets.getHashedSetIndex(objects[0])
+	if !slices.ContainsFunc(objects[1:], func(object string) bool {
+		return sets.getHashedSetIndex(object) != firstSet
+	}) {
+		for n := 0; ; n++ {
+			object := fmt.Sprintf("v/cross-set-%d", n)
+			if sets.getHashedSetIndex(object) != firstSet {
+				objects = append(objects, object)
+				break
+			}
+		}
+	}
+
+	uploadIDs := make(map[string]string, len(objects))
+	for _, object := range objects {
+		mp, err := z.NewMultipartUpload(t.Context(), bucket, object, ObjectOptions{})
+		if err != nil {
+			t.Fatalf("NewMultipartUpload(%q): %v", object, err)
+		}
+		uploadIDs[object] = mp.UploadID
+	}
+
+	// Durable multipart metadata, rather than this node-local cache, must be
+	// authoritative after a restart or when another node handles the request.
+	z.mpCache.Range(func(uploadID string, _ MultipartInfo) bool {
+		z.mpCache.Delete(uploadID)
+		return true
+	})
+
+	all, err := z.ListMultipartUploads(t.Context(), bucket, "", "", "", "", 100)
+	if err != nil {
+		t.Fatal(err)
+	}
+	requireMultipartUploadKeys(t, all, objects...)
+	if all.IsTruncated || all.NextKeyMarker != "" || all.NextUploadIDMarker != "" {
+		t.Fatalf("complete listing has truncation state: %+v", all)
+	}
+
+	first, err := z.ListMultipartUploads(t.Context(), bucket, "", "", "", "", 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	requireMultipartUploadKeys(t, first, objects[0])
+	if !first.IsTruncated || first.NextKeyMarker != objects[0] || first.NextUploadIDMarker != uploadIDs[objects[0]] {
+		t.Fatalf("first page markers = (%q, %q, %t), want (%q, %q, true)",
+			first.NextKeyMarker, first.NextUploadIDMarker, first.IsTruncated,
+			objects[0], uploadIDs[objects[0]])
+	}
+
+	rest, err := z.ListMultipartUploads(t.Context(), bucket, "", first.NextKeyMarker, first.NextUploadIDMarker, "", 100)
+	if err != nil {
+		t.Fatal(err)
+	}
+	requireMultipartUploadKeys(t, rest, objects[1:]...)
+
+	afterKey, err := z.ListMultipartUploads(t.Context(), bucket, "", objects[1], "", "", 100)
+	if err != nil {
+		t.Fatal(err)
+	}
+	requireMultipartUploadKeys(t, afterKey, objects[2:]...)
+
+	prefixed, err := z.ListMultipartUploads(t.Context(), bucket, "t/", "", "", "", 100)
+	if err != nil {
+		t.Fatal(err)
+	}
+	requireMultipartUploadKeys(t, prefixed, objects[:3]...)
+
+	nested, err := z.ListMultipartUploads(t.Context(), bucket, "t/a_b/", "", "", "", 100)
+	if err != nil {
+		t.Fatal(err)
+	}
+	requireMultipartUploadKeys(t, nested, objects[:2]...)
+
+	grouped, err := z.ListMultipartUploads(t.Context(), bucket, "t/", "", "", SlashSeparator, 100)
+	if err != nil {
+		t.Fatal(err)
+	}
+	requireMultipartUploadKeys(t, grouped)
+	if want := []string{"t/a_b/", "t/c_d/"}; !slices.Equal(grouped.CommonPrefixes, want) {
+		t.Fatalf("common prefixes = %v, want %v", grouped.CommonPrefixes, want)
+	}
+
+	groupPage, err := z.ListMultipartUploads(t.Context(), bucket, "t/", "", "", SlashSeparator, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []string{"t/a_b/"}; !slices.Equal(groupPage.CommonPrefixes, want) {
+		t.Fatalf("first common-prefix page = %v, want %v", groupPage.CommonPrefixes, want)
+	}
+	if !groupPage.IsTruncated || groupPage.NextKeyMarker != "t/a_b/" || groupPage.NextUploadIDMarker != "" {
+		t.Fatalf("common-prefix page markers = (%q, %q, %t)",
+			groupPage.NextKeyMarker, groupPage.NextUploadIDMarker, groupPage.IsTruncated)
+	}
+
+	groupRest, err := z.ListMultipartUploads(t.Context(), bucket, "t/", groupPage.NextKeyMarker, "", SlashSeparator, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []string{"t/c_d/"}; !slices.Equal(groupRest.CommonPrefixes, want) {
+		t.Fatalf("second common-prefix page = %v, want %v", groupRest.CommonPrefixes, want)
+	}
+	if groupRest.IsTruncated {
+		t.Fatalf("last common-prefix page is truncated: %+v", groupRest)
+	}
+
+	part, err := z.PutObjectPart(t.Context(), bucket, objects[0], uploadIDs[objects[0]], 1,
+		mustGetPutObjReader(t, bytes.NewBufferString("part"), 4, "", ""), ObjectOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	completed, err := z.CompleteMultipartUpload(t.Context(), bucket, objects[0], uploadIDs[objects[0]],
+		[]CompletePart{{PartNumber: 1, ETag: part.ETag}}, ObjectOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, key := range []string{multipartMetaBucket, multipartMetaObject} {
+		if _, ok := completed.UserDefined[key]; ok {
+			t.Errorf("completed object retained upload-only metadata %q", key)
+		}
+	}
+
+	// Simulate an upload written by a pre-upgrade server. Its key cannot be
+	// recovered by scanning the hashed namespace. Strict listing must fail;
+	// the old path is available only through an explicit migration setting.
+	legacyObject := objects[1]
+	er := sets.getHashedSet(legacyObject)
+	fi, metadata, err := er.checkUploadIDExists(t.Context(), bucket, legacyObject, uploadIDs[legacyObject], true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i := range metadata {
+		delete(metadata[i].Metadata, multipartMetaBucket)
+		delete(metadata[i].Metadata, multipartMetaObject)
+	}
+	if _, err = writeAllMetadata(t.Context(), er.getDisks(), bucket, minioMetaMultipartBucket,
+		er.getUploadIDDir(bucket, legacyObject, uploadIDs[legacyObject]), metadata, fi.WriteQuorum(er.defaultWQuorum())); err != nil {
+		t.Fatal(err)
+	}
+	_, err = z.ListMultipartUploads(t.Context(), bucket, legacyObject, "", "", "", 100)
+	if !errors.Is(err, errMultipartListingLegacy) {
+		t.Fatalf("legacy strict listing: %v", err)
+	}
+	globalAPIConfig.mu.Lock()
+	oldLegacy := globalAPIConfig.multipartListingLegacy
+	globalAPIConfig.multipartListingLegacy = true
+	globalAPIConfig.mu.Unlock()
+	t.Cleanup(func() {
+		globalAPIConfig.mu.Lock()
+		globalAPIConfig.multipartListingLegacy = oldLegacy
+		globalAPIConfig.mu.Unlock()
+	})
+	legacy, err := z.ListMultipartUploads(t.Context(), bucket, legacyObject, "", "", "", 100)
+	if err != nil {
+		t.Fatal(err)
+	}
+	requireMultipartUploadKeys(t, legacy, legacyObject)
+}
+
+func TestPaginateMultipartUploads(t *testing.T) {
+	base := time.Unix(100, 0)
+	id1, id2, id3 := multipartListingTestID(base, 1), multipartListingTestID(base.Add(time.Second), 2), multipartListingTestID(base, 3)
+	uploads := []MultipartInfo{
+		{Bucket: "bucket", Object: "b", UploadID: id3, Initiated: base},
+		{Bucket: "bucket", Object: "a", UploadID: id2, Initiated: base.Add(time.Second)},
+		{Bucket: "bucket", Object: "a", UploadID: id1, Initiated: base},
+		{Bucket: "bucket", Object: "a", UploadID: id1, Initiated: base}, // duplicate discovery
+	}
+
+	first := paginateMultipartUploads(uploads, "", "", "", "", 1)
+	requireMultipartUploadKeys(t, first, "a")
+	if !first.IsTruncated || first.NextKeyMarker != "a" || first.NextUploadIDMarker != id1 {
+		t.Fatalf("first page = %+v", first)
+	}
+
+	second := paginateMultipartUploads(uploads, "", first.NextKeyMarker, first.NextUploadIDMarker, "", 1)
+	if len(second.Uploads) != 1 || second.Uploads[0].Object != "a" || second.Uploads[0].UploadID != id2 {
+		t.Fatalf("second page uploads = %+v", second.Uploads)
+	}
+	if !second.IsTruncated || second.NextKeyMarker != "a" || second.NextUploadIDMarker != id2 {
+		t.Fatalf("second page = %+v", second)
+	}
+
+	last := paginateMultipartUploads(uploads, "", second.NextKeyMarker, second.NextUploadIDMarker, "", 1)
+	requireMultipartUploadKeys(t, last, "b")
+	if last.IsTruncated || last.NextKeyMarker != "" || last.NextUploadIDMarker != "" {
+		t.Fatalf("last page = %+v", last)
+	}
+
+	missingUploadMarker := paginateMultipartUploads(uploads, "", "a", multipartListingTestID(base.Add(2*time.Second), 4), "", 10)
+	requireMultipartUploadKeys(t, missingUploadMarker, "b")
+
+	if err := checkListMultipartArgs(t.Context(), "bucket", "", "", "not-base64=", ""); err != nil {
+		t.Fatalf("upload-id-marker without key-marker must be ignored: %v", err)
+	}
+
+	overLimit := make([]MultipartInfo, maxUploadsList+1)
+	for i := range overLimit {
+		overLimit[i] = MultipartInfo{Bucket: "bucket", Object: fmt.Sprintf("%04d", i), UploadID: fmt.Sprint(i)}
+	}
+	capped := paginateMultipartUploads(overLimit, "", "", "", "", maxUploadsList+1)
+	if capped.MaxUploads != maxUploadsList || len(capped.Uploads) != maxUploadsList || !capped.IsTruncated {
+		t.Fatalf("over-limit page = MaxUploads %d, uploads %d, truncated %t",
+			capped.MaxUploads, len(capped.Uploads), capped.IsTruncated)
+	}
+}
+
+func TestListMultipartUploadsGlobalPageAcrossPools(t *testing.T) {
+	z, bucket := consistencyPools(t)
+	objects := []string{"a/one", "b/two", "c/three", "d/four"}
+	for i, object := range objects {
+		if _, err := z.serverPools[i%len(z.serverPools)].NewMultipartUpload(t.Context(), bucket, object, ObjectOptions{}); err != nil {
+			t.Fatalf("NewMultipartUpload(%q): %v", object, err)
+		}
+	}
+	z.mpCache.Range(func(uploadID string, _ MultipartInfo) bool {
+		z.mpCache.Delete(uploadID)
+		return true
+	})
+
+	page, err := z.ListMultipartUploads(t.Context(), bucket, "", "", "", "", 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	requireMultipartUploadKeys(t, page, objects[:2]...)
+	if !page.IsTruncated || page.NextKeyMarker != objects[1] {
+		t.Fatalf("first global page = %+v", page)
+	}
+
+	rest, err := z.ListMultipartUploads(t.Context(), bucket, "", page.NextKeyMarker, page.NextUploadIDMarker, "", 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	requireMultipartUploadKeys(t, rest, objects[2:]...)
+	if rest.IsTruncated {
+		t.Fatalf("last global page is truncated: %+v", rest)
+	}
+}
@@ -20,6 +20,7 @@ package cmd
 import (
 	"context"
 	"encoding/base64"
+	"errors"
 	"runtime"
 	"strings"

@@ -83,7 +84,8 @@ func checkListMultipartArgs(ctx context.Context, bucket, prefix, keyMarker, uplo
 	if err := checkListObjsArgs(ctx, bucket, prefix, keyMarker); err != nil {
 		return err
 	}
-	if uploadIDMarker != "" {
+	// S3 ignores upload-id-marker when key-marker is absent.
+	if uploadIDMarker != "" && keyMarker != "" {
 		if HasSuffix(keyMarker, SlashSeparator) {
 			return InvalidUploadIDKeyCombination{
 				UploadIDMarker: uploadIDMarker,
@@ -96,6 +98,9 @@ func checkListMultipartArgs(ctx context.Context, bucket, prefix, keyMarker, uplo
 				UploadID: uploadIDMarker,
 			}
 		}
+		if _, ok := multipartMarkerTime(uploadIDMarker); !ok {
+			return InvalidArgument{Bucket: bucket, Object: keyMarker, Err: errors.New("upload-id-marker must contain a native multipart upload ID")}
+		}
 	}
 	return nil
 }
@@ -240,7 +240,10 @@ func checkPreconditionsPUT(ctx context.Context, w http.ResponseWriter, r *http.R
 	// updated. The predicate is the incoming request's restored SSE-C metadata,
 	// not what the destination happens to hold.
 	ssecReplica := isReplicaTrusted(r.Context()) && crypto.SSEC.IsEncrypted(opts.UserDefined)
-	if etagMatch && vidMatch && !ssecReplica {
+	// Matching content does not imply that its tag revision was delivered.
+	// Keep client preconditions above; relax only the internal duplicate check.
+	newerTags := isReplicaTrusted(r.Context()) && olderThan(objInfo.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp], opts.ReplicationSourceTaggingTimestamp)
+	if etagMatch && vidMatch && !ssecReplica && !newerTags {
 		writeHeaders()
 		writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrPreconditionFailed), r.URL)
 		return true
@@ -1797,6 +1797,7 @@ func (api objectAPIHandlers) CopyObjectHandler(w http.ResponseWriter, r *http.Re
 	// source timestamp is newer than the stored one, and a stale update must
 	// leave the stored state in place instead of erasing it.
 	storedLock := storedObjectLockState(srcInfo.UserDefined)
+	storedTagTimestamp := srcInfo.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp]

 	srcInfo.UserDefined, err = getCpObjMetadataFromHeader(ctx, r, srcInfo.UserDefined, allowReplicationMetadata)
 	if err != nil {
@@ -1814,23 +1815,29 @@ func (api objectAPIHandlers) CopyObjectHandler(w http.ResponseWriter, r *http.Re
 		}
 	}

-	if objTags != "" {
-		lastTaggingTimestamp := srcInfo.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp]
-		if dstOpts.ReplicationRequest {
-			srcTimestamp := dstOpts.ReplicationSourceTaggingTimestamp
-			if !srcTimestamp.IsZero() {
-				ondiskTimestamp, err := time.Parse(time.RFC3339Nano, lastTaggingTimestamp)
-				// update tagging metadata only if replica  timestamp is newer than what's on disk
-				if err != nil || (err == nil && !ondiskTimestamp.After(srcTimestamp)) {
-					srcInfo.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp] = srcTimestamp.UTC().Format(time.RFC3339Nano)
-					srcInfo.UserDefined[xhttp.AmzObjectTagging] = objTags
-				}
-			}
-		} else {
+	if dstOpts.ReplicationRequest {
+		srcTimestamp := dstOpts.ReplicationSourceTaggingTimestamp
+		if !srcTimestamp.IsZero() {
+			// An empty value with a timestamp is an ordered deletion. Recheck
+			// the captured state even if metadata REPLACE rebuilt the map.
+			srcInfo.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp] = srcTimestamp.UTC().Format(time.RFC3339Nano)
 			srcInfo.UserDefined[xhttp.AmzObjectTagging] = objTags
-			srcInfo.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp] = UTCNow().Format(time.RFC3339Nano)
+			reconcileStoredObjectTags(srcInfo.UserDefined, srcInfo.UserTags, storedTagTimestamp)
+		} else {
+			srcInfo.UserDefined[xhttp.AmzObjectTagging] = srcInfo.UserTags
+			if storedTagTimestamp != "" {
+				srcInfo.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp] = storedTagTimestamp
+			} else {
+				delete(srcInfo.UserDefined, ReservedMetadataPrefixLower+TaggingTimestamp)
+			}
 		}
+	} else {
+		srcInfo.UserDefined[xhttp.AmzObjectTagging] = objTags
+		srcInfo.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp] = UTCNow().Format(time.RFC3339Nano)
 	}
+	// SSE-C rotation snapshots reserved metadata before the tag decision. Its
+	// later merge must not put the old timestamp back over the accepted state.
+	delete(encMetadata, ReservedMetadataPrefixLower+TaggingTimestamp)

 	srcInfo.UserDefined = filterReplicationStatusMetadata(srcInfo.UserDefined)
 	srcInfo.UserDefined = objectlock.FilterObjectLockMetadata(srcInfo.UserDefined, true, true)
@@ -2313,6 +2320,9 @@ func (api objectAPIHandlers) PutObjectHandler(w http.ResponseWriter, r *http.Req
 		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
 		return
 	}
+	if opts.ReplicationRequest && !opts.ReplicationSourceTaggingTimestamp.IsZero() {
+		metadata[ReservedMetadataPrefixLower+TaggingTimestamp] = opts.ReplicationSourceTaggingTimestamp.UTC().Format(time.RFC3339Nano)
+	}

 	actualSize := size
 	var idxCb func() []byte
@@ -3760,11 +3770,11 @@ func (api objectAPIHandlers) PutObjectTaggingHandler(w http.ResponseWriter, r *h
 	}

 	dsc := mustReplicate(ctx, bucket, object, getMustReplicateOptions(objInfo.UserDefined, tagsStr, objInfo.ReplicationStatus, replication.MetadataReplicationType, opts))
+	stamp := UTCNow().Format(time.RFC3339Nano)
+	opts.UserDefined = map[string]string{ReservedMetadataPrefixLower + TaggingTimestamp: stamp}
 	if dsc.ReplicateAny() {
-		opts.UserDefined = make(map[string]string)
-		opts.UserDefined[ReservedMetadataPrefixLower+ReplicationTimestamp] = UTCNow().Format(time.RFC3339Nano)
+		opts.UserDefined[ReservedMetadataPrefixLower+ReplicationTimestamp] = stamp
 		opts.UserDefined[ReservedMetadataPrefixLower+ReplicationStatus] = dsc.PendingStatus()
-		opts.UserDefined[ReservedMetadataPrefixLower+TaggingTimestamp] = UTCNow().Format(time.RFC3339Nano)
 	}

 	// Put object tags
@@ -3863,9 +3873,10 @@ func (api objectAPIHandlers) DeleteObjectTaggingHandler(w http.ResponseWriter, r
 	}

 	dsc := mustReplicate(ctx, bucket, object, oi.getMustReplicateOptions(replication.MetadataReplicationType, opts))
+	stamp := UTCNow().Format(time.RFC3339Nano)
+	opts.UserDefined = map[string]string{ReservedMetadataPrefixLower + TaggingTimestamp: stamp}
 	if dsc.ReplicateAny() {
-		opts.UserDefined = make(map[string]string)
-		opts.UserDefined[ReservedMetadataPrefixLower+ReplicationTimestamp] = UTCNow().Format(time.RFC3339Nano)
+		opts.UserDefined[ReservedMetadataPrefixLower+ReplicationTimestamp] = stamp
 		opts.UserDefined[ReservedMetadataPrefixLower+ReplicationStatus] = dsc.PendingStatus()
 	}

@@ -312,6 +312,10 @@ func (api objectAPIHandlers) NewMultipartUploadHandler(w http.ResponseWriter, r
 		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
 		return
 	}
+	// Completion orders the upload's persisted tag state under the object lock.
+	if opts.ReplicationRequest && !opts.ReplicationSourceTaggingTimestamp.IsZero() {
+		metadata[ReservedMetadataPrefixLower+TaggingTimestamp] = opts.ReplicationSourceTaggingTimestamp.UTC().Format(time.RFC3339Nano)
+	}

 	if r.Header.Get(xhttp.IfMatch) != "" {
 		opts.HasIfMatch = true
@@ -106,6 +106,7 @@ func TestReplicateDeleteMarkerTargetSemantics(t *testing.T) {

 func testReplicateDeleteMarkerPurge(obj ObjectLayer, instanceType, bucket string, router http.Handler, creds auth.Credentials, t *testing.T, legacy bool) {
 	ctx := t.Context()
+	defer replicationTestCapacity(obj)()
 	const arn = "arn:minio:replication::af470089-d354-4473-934c-9e1f52f6da89:bucket"
 	const name = "marker"
 	version := mustGetUUID()
@@ -208,27 +209,12 @@ func testReplicateDeleteMarkerPurge(obj ObjectLayer, instanceType, bucket string
 		t.Errorf("purge scheduled as marker creation: version=%q marker=%q", deletion.VersionID, deletion.DeleteMarkerVersionID)
 	}
 	if legacy {
-		// Reproduce the old producer's state and let the existing scanner/heal
-		// path recover it. Upgrades must also finish purges already left pending.
+		// Old task shapes must complete directly; scanner/MRF recovery is
+		// covered separately by TestReplicationMRFMarkerRecovery.
 		deletion.VersionID, deletion.DeleteMarkerVersionID = "", version
-		replicateDelete(ctx, deletion, obj)
-		oi, _ := obj.GetObjectInfo(ctx, bucket, name, ObjectOptions{VersionID: version, Versioned: true})
-		if oi.VersionPurgeStatus != replication.VersionPurgePending {
-			t.Fatalf("legacy source purge = %s, want PENDING", oi.VersionPurgeStatus)
-		}
-		targets, err := globalBucketTargetSys.ListBucketTargets(ctx, bucket)
-		if err != nil {
-			t.Fatal(err)
-		}
-		queueReplicationHeal(ctx, bucket, oi, replicationConfig{Config: &cfg, remotes: targets}, 0)
-		select {
-		case op := <-worker:
-			deletion = op.(DeletedObjectReplicationInfo)
-		case <-time.After(time.Second):
-			t.Fatal("legacy pending purge was not scheduled for healing")
-		}
 	}
-	result := replicateDelete(context.Background(), deletion, obj)
+
+	result := replicateDelete(context.Background(), deletion, markerPurgeUpdateLayer{ObjectLayer: obj, t: t})
 	if result.VersionPurgeStatus() != replication.VersionPurgeComplete {
 		t.Errorf("remote purge result = %s, want COMPLETE", result.VersionPurgeStatus())
 	}
@@ -0,0 +1,628 @@
+// Copyright (c) 2026 Feng Ruohang
+//
+// This file is part of Silo Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/minio/madmin-go/v3"
+	"github.com/minio/minio-go/v7"
+	"github.com/minio/minio/internal/auth"
+	"github.com/minio/minio/internal/bucket/replication"
+	xhttp "github.com/minio/minio/internal/http"
+	"github.com/minio/minio/internal/logger"
+	loghttp "github.com/minio/minio/internal/logger/target/http"
+	"github.com/minio/minio/internal/once"
+	xnet "github.com/pgsty/silo-pkg/v3/net"
+)
+
+type markerRecoveryCase struct {
+	name                                                                                                          string
+	legacy, creation, lostReply, partial, exhaust, lockFirst, invalidMRF, replicaSource, offline, unrecordedPurge bool
+	targets                                                                                                       int
+}
+
+func TestReplicationMRFMarkerRecovery(t *testing.T) {
+	for _, tc := range []markerRecoveryCase{
+		{name: "canonical", targets: 1},
+		{name: "lock-failure", lockFirst: true, targets: 1},
+		{name: "invalid-MRF-metadata", invalidMRF: true, targets: 1},
+		{name: "legacy", legacy: true, targets: 1},
+		{name: "unrecorded-purge", unrecordedPurge: true, targets: 2},
+		{name: "two-targets", legacy: true, targets: 2},
+		{name: "two-targets-offline", offline: true, targets: 2},
+		{name: "replica-source", replicaSource: true, targets: 1},
+		{name: "lost-reply-canonical", lostReply: true, targets: 1},
+		{name: "lost-reply-legacy", legacy: true, lostReply: true, targets: 1},
+		{name: "creation", creation: true, targets: 1},
+		{name: "partial-creation-block", partial: true, targets: 2},
+		{name: "retry-budget-and-scanner", exhaust: true, targets: 1},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{t: t, endpoints: []string{"DeleteObject"}, objAPITest: func(obj ObjectLayer, backend, bucket string, router http.Handler, creds auth.Credentials, t *testing.T) {
+				testReplicationMRFMarkerRecovery(t, obj, backend, bucket, router, creds, tc)
+			}})
+		})
+	}
+}
+
+type markerRecoveryTarget struct {
+	arn, bucket       string
+	client            *minio.Client
+	reject, loseReply atomic.Bool
+	deletes           atomic.Int32
+}
+
+// Only adapt host capacity accounting, using the existing real-disk adapter.
+// Reads, object metadata, MRF files and writes all still use the fixture disks.
+func replicationTestCapacity(obj ObjectLayer) func() {
+	var restore []func()
+	for _, pool := range obj.(*erasureServerPools).serverPools {
+		for _, set := range pool.sets {
+			original := set.getDisks
+			disks := append([]StorageAPI(nil), original()...)
+			for i, disk := range disks {
+				if disk != nil {
+					disks[i] = tagTestCapacityDisk{StorageAPI: disk}
+				}
+			}
+			set.getDisks = func() []StorageAPI { return disks }
+			restore = append(restore, func() { set.getDisks = original })
+		}
+	}
+	return func() {
+		for _, fn := range restore {
+			fn()
+		}
+	}
+}
+
+func testReplicationMRFMarkerRecovery(t *testing.T, obj ObjectLayer, backend, bucket string, router http.Handler, creds auth.Credentials, tc markerRecoveryCase) {
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	defer replicationTestCapacity(obj)()
+	stats := NewReplicationStats(ctx, nil)
+	oldStats := globalReplicationStats.Swap(stats)
+	defer globalReplicationStats.Store(oldStats)
+	oldPool := globalReplicationPool
+	defer func() { globalReplicationPool = oldPool }()
+	const name = "marker"
+	version := mustGetUUID()
+	creationTime := UTCNow().Add(-time.Hour).Truncate(time.Second)
+	if _, err := globalBucketMetadataSys.Update(ctx, bucket, bucketVersioningConfig, enabledBucketVersioningConfig); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := obj.PutObject(ctx, bucket, name, mustGetPutObjReader(t, bytes.NewReader([]byte("data")), 4, "", ""), ObjectOptions{Versioned: true}); err != nil {
+		t.Fatal(err)
+	}
+	var targets []*markerRecoveryTarget
+	cfg := replication.Config{}
+	creationStates := make(map[string]replication.StatusType)
+	var creationInternal string
+	for i := 0; i < tc.targets; i++ {
+		target := &markerRecoveryTarget{arn: "arn:minio:replication::" + mustGetUUID() + ":bucket", bucket: getRandomBucketName()}
+		if err := obj.MakeBucket(ctx, target.bucket, MakeBucketOptions{}); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := obj.PutObject(ctx, target.bucket, name, mustGetPutObjReader(t, bytes.NewReader([]byte("data")), 4, "", ""), ObjectOptions{Versioned: true}); err != nil {
+			t.Fatal(err)
+		}
+		if !tc.creation {
+			opts := ObjectOptions{VersionID: version, Versioned: true, DeleteMarker: true, ReplicationRequest: true, MTime: creationTime}
+			opts.SetReplicaStatus(replication.Replica)
+			if _, err := obj.DeleteObject(ctx, target.bucket, name, opts); err != nil {
+				t.Fatal(err)
+			}
+		}
+		remote := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			opts := ObjectOptions{VersionID: r.URL.Query().Get("versionId"), Versioned: true}
+			switch r.Method {
+			case http.MethodHead:
+				oi, err := obj.GetObjectInfo(r.Context(), target.bucket, name, opts)
+				if oi.DeleteMarker {
+					w.Header().Set(xhttp.AmzDeleteMarker, "true")
+					w.Header().Set(xhttp.AmzVersionID, oi.VersionID)
+				}
+				if err != nil {
+					writeErrorResponseHeadersOnly(w, toAPIError(r.Context(), err))
+					return
+				}
+				w.WriteHeader(http.StatusOK)
+			case http.MethodDelete:
+				target.deletes.Add(1)
+				if got := r.Header.Get(xhttp.MinIOSourceDeleteMarker) == "true"; got != tc.creation {
+					t.Errorf("purge/creation wire flag=%v creation=%v", got, tc.creation)
+				}
+				if opts.VersionID == "" {
+					t.Error("missing remote versionId")
+				}
+				if target.reject.Load() {
+					w.WriteHeader(http.StatusForbidden)
+					fmt.Fprint(w, `<Error><Code>AccessDenied</Code></Error>`)
+					return
+				}
+				opts.DeleteMarker = r.Header.Get(xhttp.MinIOSourceDeleteMarker) == "true"
+				opts.ReplicationRequest = true
+				opts.SetReplicaStatus(replication.Replica)
+				_, err := obj.DeleteObject(r.Context(), target.bucket, name, opts)
+				if err != nil && !isErrVersionNotFound(err) && !isErrObjectNotFound(err) {
+					writeErrorResponse(r.Context(), w, toAPIError(r.Context(), err), r.URL)
+					return
+				}
+				if target.loseReply.Swap(false) {
+					conn, _, err := w.(http.Hijacker).Hijack()
+					if err != nil {
+						t.Error(err)
+						return
+					}
+					conn.Close()
+					return
+				}
+				w.WriteHeader(http.StatusNoContent)
+			default:
+				t.Errorf("unexpected remote method %s", r.Method)
+			}
+		}))
+		defer remote.Close()
+		client, err := minio.New(strings.TrimPrefix(remote.URL, "http://"), &minio.Options{Region: "us-east-1", MaxRetries: 1})
+		if err != nil {
+			t.Fatal(err)
+		}
+		target.client = client
+		globalBucketTargetSys.Lock()
+		globalBucketTargetSys.arnRemotesMap[target.arn] = arnTarget{Client: &TargetClient{Client: client, ARN: target.arn, Bucket: target.bucket}, lastRefresh: UTCNow()}
+		globalBucketTargetSys.targetsMap[bucket] = append(globalBucketTargetSys.targetsMap[bucket], madmin.BucketTarget{Arn: target.arn, TargetBucket: target.bucket})
+		globalBucketTargetSys.Unlock()
+		globalBucketTargetSys.hMutex.Lock()
+		globalBucketTargetSys.hc[client.EndpointURL().Host] = epHealth{Online: true}
+		globalBucketTargetSys.hMutex.Unlock()
+		rule := configs[0].Rules[0]
+		rule.Priority = i + 1
+		rule.Destination = replication.Destination{ARN: target.arn, Bucket: target.bucket}
+		cfg.Rules = append(cfg.Rules, rule)
+		creationStates[target.arn] = replication.Completed
+		creationInternal += target.arn + "=COMPLETED;"
+		targets = append(targets, target)
+	}
+	if tc.targets == 1 {
+		cfg.RoleArn = targets[0].arn
+	}
+	if !tc.creation {
+		opts := ObjectOptions{VersionID: version, Versioned: true, DeleteMarker: true, MTime: creationTime, DeleteReplication: ReplicationState{Targets: creationStates, ReplicationStatusInternal: creationInternal, ReplicationTimeStamp: creationTime}}
+		if tc.replicaSource {
+			opts.DeleteReplication = ReplicationState{}
+			opts.SetReplicaStatus(replication.Replica)
+		}
+		if _, err := obj.DeleteObject(ctx, bucket, name, opts); err != nil {
+			t.Fatal(err)
+		}
+	}
+	meta, err := globalBucketMetadataSys.Get(bucket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	meta.replicationConfig = &cfg
+	globalBucketMetadataSys.Set(bucket, meta)
+	newPool := func() *ReplicationPool {
+		p := &ReplicationPool{ctx: ctx, objLayer: obj, workers: []chan ReplicationWorkerOperation{make(chan ReplicationWorkerOperation, 8)}, stats: stats, mrfSaveCh: make(chan MRFReplicateEntry, 8)}
+		globalReplicationPool = once.NewSingleton[ReplicationPool]()
+		globalReplicationPool.Set(p)
+		return p
+	}
+	p := newPool()
+	receive := func() DeletedObjectReplicationInfo {
+		select {
+		case op := <-p.workers[0]:
+			d, ok := op.(DeletedObjectReplicationInfo)
+			if !ok {
+				t.Fatalf("wrong queued operation %T", op)
+			}
+			return d
+		case <-time.After(3 * time.Second):
+			t.Fatal("no marker task from actual MRF/handler/scanner queue")
+			return DeletedObjectReplicationInfo{}
+		}
+	}
+	uri := "/" + bucket + "/" + name
+	if !tc.creation {
+		uri += "?versionId=" + version
+	}
+	req, err := newTestSignedRequestV4(http.MethodDelete, uri, 0, nil, creds.AccessKey, creds.SecretKey, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+	if w.Code != http.StatusNoContent {
+		t.Fatalf("source DELETE status %d: %s", w.Code, w.Body)
+	}
+	deletion := receive()
+	if tc.creation {
+		version = deletion.DeleteMarkerVersionID
+	} else if deletion.VersionID != version || deletion.DeleteMarkerVersionID != "" {
+		t.Fatalf("current producer emitted noncanonical purge: %+v", deletion)
+	}
+	if tc.unrecordedPurge {
+		// Exercise a task carrying purge state while the disk marker still has
+		// only creation metadata. Recreate only this isolated fixture marker.
+		if _, err := obj.DeleteObject(ctx, bucket, name, ObjectOptions{VersionID: version, Versioned: true}); err != nil {
+			t.Fatal(err)
+		}
+		opts := ObjectOptions{VersionID: version, Versioned: true, DeleteMarker: true, MTime: creationTime, DeleteReplication: ReplicationState{Targets: creationStates, ReplicationStatusInternal: creationInternal, ReplicationTimeStamp: creationTime}}
+		if _, err := obj.DeleteObject(ctx, bucket, name, opts); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if tc.legacy {
+		deletion.VersionID, deletion.DeleteMarkerVersionID = "", version
+	}
+	if tc.partial {
+		deletion.TargetArn = targets[len(targets)-1].arn
+	}
+	if tc.invalidMRF {
+		testReplicationMRFInvalidLookups(ctx, t, obj, p, newPool, deletion)
+		return
+	}
+	var auditStatuses <-chan string
+	if tc.name == "canonical" {
+		var stopAudit func()
+		auditStatuses, stopAudit = replicationTestAudit(ctx, t, bucket)
+		defer stopAudit()
+	}
+	assertAudit := func(want string) {
+		if auditStatuses == nil {
+			return
+		}
+		select {
+		case got := <-auditStatuses:
+			if got != want {
+				t.Fatalf("replication audit status=%q want %q", got, want)
+			}
+		case <-time.After(3 * time.Second):
+			t.Fatal("missing replication audit event")
+		}
+	}
+	deletion.OpType = replication.HealReplicationType // Exercise operation-status statistics too.
+	failing := targets[len(targets)-1]
+	failing.reject.Store(!tc.lostReply)
+	failing.loseReply.Store(tc.lostReply)
+	if tc.offline {
+		globalBucketTargetSys.hMutex.Lock()
+		globalBucketTargetSys.hc[failing.client.EndpointURL().Host] = epHealth{Online: false}
+		globalBucketTargetSys.hMutex.Unlock()
+	}
+	before, _ := obj.GetObjectInfo(ctx, bucket, name, ObjectOptions{VersionID: version})
+	beforeCreation := before.ReplicationStatusInternal
+	beforeStamp := before.UserDefined[ReservedMetadataPrefixLower+ReplicationTimestamp]
+	beforeReplica := before.UserDefined[ReservedMetadataPrefixLower+ReplicaStatus]
+	beforeReplicaStamp := before.UserDefined[ReservedMetadataPrefixLower+ReplicaTimestamp]
+	if !tc.creation && !tc.replicaSource && (len(replicationStatusesMap(beforeCreation)) != tc.targets || beforeStamp == "") {
+		t.Fatalf("missing seeded creation block: %+v", before)
+	}
+	if tc.replicaSource && (beforeReplica != "REPLICA" || beforeReplicaStamp == "") {
+		t.Fatalf("missing replica block: %+v", before)
+	}
+	updateObj := obj
+	if !tc.creation {
+		updateObj = markerPurgeUpdateLayer{ObjectLayer: obj, t: t}
+	}
+	rounds := 2
+	if tc.lostReply {
+		rounds = 1
+	}
+	if tc.exhaust {
+		rounds = mrfRetryLimit + 1
+	}
+	for round := 1; round <= rounds; round++ {
+		callObj := updateObj
+		if tc.lockFirst && round == 1 {
+			callObj = markerLockFailureLayer{ObjectLayer: updateObj}
+		}
+		result := replicateDelete(ctx, deletion, callObj)
+		switch {
+		case tc.lockFirst && round == 1:
+			if len(result.Targets) != 0 {
+				t.Fatal("lock failure attempted a target")
+			}
+		case tc.creation:
+			if result.ReplicationStatus() != replication.Failed {
+				t.Fatalf("creation result: %+v", result)
+			}
+		case result.VersionPurgeStatus() != replication.VersionPurgeFailed:
+			t.Fatalf("purge failure result: %+v", result)
+		}
+		assertAudit("FAILED")
+		if round == 1 && !tc.lockFirst && !tc.creation {
+			stats.RLock()
+			failed := stats.Cache[bucket].Stats[failing.arn].FailStats.SinceUptime
+			stats.RUnlock()
+			if failed.Count != 1 || failed.Bytes != 0 {
+				t.Fatalf("purge failure stats=%+v, want count 1 and zero bytes", failed)
+			}
+		}
+		oi, err := obj.GetObjectInfo(ctx, bucket, name, ObjectOptions{VersionID: version})
+		if !isErrMethodNotAllowed(err) || !oi.DeleteMarker {
+			t.Fatalf("source marker metadata/405 missing: %+v %v", oi, err)
+		}
+		if !tc.creation && (oi.ReplicationStatusInternal != beforeCreation || oi.UserDefined[ReservedMetadataPrefixLower+ReplicationTimestamp] != beforeStamp) {
+			t.Fatalf("purge rewrote creation block: before=%q/%q after=%q/%q", beforeCreation, beforeStamp, oi.ReplicationStatusInternal, oi.UserDefined[ReservedMetadataPrefixLower+ReplicationTimestamp])
+		}
+		if !tc.creation && (oi.UserDefined[ReservedMetadataPrefixLower+ReplicaStatus] != beforeReplica || oi.UserDefined[ReservedMetadataPrefixLower+ReplicaTimestamp] != beforeReplicaStamp) {
+			t.Fatal("purge rewrote replica block")
+		}
+		if tc.targets == 2 && !tc.partial {
+			purges := versionPurgeStatusesMap(oi.VersionPurgeStatusInternal)
+			if purges[targets[0].arn] != replication.VersionPurgeComplete || purges[failing.arn] != replication.VersionPurgeFailed {
+				t.Fatalf("incorrect persisted target states: %v", purges)
+			}
+			if targets[0].deletes.Load() != 1 {
+				t.Fatalf("successful target resent %d times", targets[0].deletes.Load())
+			}
+		}
+		if tc.partial {
+			select {
+			case <-p.mrfSaveCh:
+			default:
+				t.Fatal("partial failure missing MRF")
+			}
+			dsc := deletion.ReplicationState.ReplicateDecisionStr
+			deletion.ReplicationState = oi.ReplicationState()
+			deletion.ReplicationState.ReplicateDecisionStr = dsc
+			continue
+		}
+		if tc.exhaust && round > mrfRetryLimit {
+			if len(p.mrfSaveCh) != 0 || atomic.LoadUint64(&stats.mrfStats.TotalDroppedCount) != 1 {
+				t.Fatalf("retry budget not applied: queued=%d drops=%d", len(p.mrfSaveCh), stats.mrfStats.TotalDroppedCount)
+			}
+			break
+		}
+		var entry MRFReplicateEntry
+		select {
+		case entry = <-p.mrfSaveCh:
+		default:
+			t.Fatal("failure did not enter MRF")
+		}
+		if entry.RetryCount != round || entry.versionID != version {
+			t.Fatalf("MRF entry lost identity/budget: %+v, round=%d", entry, round)
+		}
+		p.saveMRFEntries(ctx, map[string]MRFReplicateEntry{entry.versionID: entry})
+		record, err := p.loadMRF()
+		if err != nil || len(record.Entries) != 1 {
+			t.Fatalf("disk MRF missing: %+v %v", record, err)
+		}
+		if got := record.Entries[version]; got.RetryCount != round || got.Object != name || got.Bucket != bucket {
+			t.Fatalf("disk MRF mismatch: %+v", got)
+		}
+		p.saveMRFEntries(ctx, record.Entries) // loadMRF consumes the file; each replay uses a fresh disk record.
+		p = newPool()                         // no in-memory entries carried to the replacement pool.
+		if err := p.queueMRFHeal(); err != nil {
+			t.Fatal(err)
+		}
+		deletion = receive()
+		if deletion.RetryCount != round {
+			t.Fatalf("MRF retry count=%d want %d", deletion.RetryCount, round)
+		}
+		if !tc.creation && (deletion.VersionID != version || deletion.DeleteMarkerVersionID != "") {
+			t.Fatalf("MRF emitted wrong purge: %+v", deletion)
+		}
+	}
+	if tc.partial {
+		return
+	}
+	failing.reject.Store(false)
+	globalBucketTargetSys.hMutex.Lock()
+	globalBucketTargetSys.hc[failing.client.EndpointURL().Host] = epHealth{Online: true}
+	globalBucketTargetSys.hMutex.Unlock()
+	if tc.exhaust {
+		oi, _ := obj.GetObjectInfo(ctx, bucket, name, ObjectOptions{VersionID: version})
+		QueueReplicationHeal(ctx, bucket, oi, 0) // Separately prove the existing scanner fallback after MRF exhaustion.
+		deletion = receive()
+		if deletion.RetryCount != 0 {
+			t.Fatal("scanner did not start a fresh retry budget")
+		}
+	}
+	result := replicateDelete(ctx, deletion, updateObj)
+	assertAudit("COMPLETED")
+	if tc.creation {
+		if result.ReplicationStatus() != replication.Completed {
+			t.Fatalf("creation recovery failed: %+v", result)
+		}
+	} else if result.VersionPurgeStatus() != replication.VersionPurgeComplete {
+		t.Fatalf("purge recovery failed: %+v", result)
+	}
+	for _, b := range append([]string{bucket}, func() []string {
+		var b []string
+		for _, target := range targets {
+			b = append(b, target.bucket)
+		}
+		return b
+	}()...) {
+		oi, err := obj.GetObjectInfo(ctx, b, name, ObjectOptions{VersionID: version})
+		if tc.creation {
+			if !oi.DeleteMarker || !isErrMethodNotAllowed(err) {
+				t.Fatalf("creation missing in %s: %+v %v", b, oi, err)
+			}
+		} else if !isErrVersionNotFound(err) && !isErrObjectNotFound(err) {
+			t.Fatalf("purge left marker in %s: %+v %v", b, oi, err)
+		}
+	}
+	if !tc.creation {
+		// Re-deliver an ambiguous purge directly. An absent marker must stay absent.
+		duplicate := deletion
+		duplicate.VersionID, duplicate.DeleteMarkerVersionID = "", version
+		duplicate.ReplicationState.PurgeTargets = map[string]VersionPurgeStatusType{failing.arn: replication.VersionPurgePending}
+		duplicate.ReplicationState.VersionPurgeStatusInternal = ""
+		got := replicateDeleteToTarget(ctx, duplicate, &TargetClient{Client: failing.client, ARN: failing.arn, Bucket: failing.bucket})
+		if got.VersionPurgeStatus != replication.VersionPurgeComplete {
+			t.Fatalf("duplicate purge: %+v", got)
+		}
+		if oi, err := obj.GetObjectInfo(ctx, failing.bucket, name, ObjectOptions{VersionID: version}); !isErrVersionNotFound(err) && !isErrObjectNotFound(err) {
+			t.Fatalf("duplicate recreated marker: %+v %v", oi, err)
+		}
+	}
+	if len(p.mrfSaveCh) != 0 || len(p.workers[0]) != 0 {
+		t.Fatalf("completion left queued work: mrf=%d worker=%d", len(p.mrfSaveCh), len(p.workers[0]))
+	}
+	if !tc.creation && !tc.exhaust && !tc.lostReply {
+		stats.RLock()
+		got := stats.Cache[bucket].Stats[failing.arn].ReplicatedCount
+		size := stats.Cache[bucket].Stats[failing.arn].ReplicatedSize
+		stats.RUnlock()
+		if got != 1 || size != 0 {
+			t.Fatalf("purge completion statistic=%d want 1", got)
+		}
+	}
+	t.Logf("%s: %s recovered; %d target(s), persisted MRF, source/target metadata checked", backend, tc.name, tc.targets)
+}
+
+func TestReplicationDeleteQueueFullRetryBudget(t *testing.T) {
+	stats := NewReplicationStats(t.Context(), nil)
+	p := &ReplicationPool{ctx: t.Context(), objLayer: &replicationMRFTestObjectLayer{}, workers: []chan ReplicationWorkerOperation{make(chan ReplicationWorkerOperation)}, stats: stats, mrfSaveCh: make(chan MRFReplicateEntry, 1), priority: "slow"}
+	d := DeletedObjectReplicationInfo{Bucket: "bucket", DeletedObject: DeletedObject{ObjectName: "marker", VersionID: mustGetUUID()}, RetryCount: 2}
+	p.queueReplicaDeleteTask(d)
+	if got := <-p.mrfSaveCh; got.RetryCount != 3 {
+		t.Fatalf("queue-full retry count=%d", got.RetryCount)
+	}
+	d.RetryCount = mrfRetryLimit
+	p.queueReplicaDeleteTask(d)
+	if len(p.mrfSaveCh) != 0 || atomic.LoadUint64(&stats.mrfStats.TotalDroppedCount) != 1 {
+		t.Fatal("queue-full retry exceeded budget without a visible drop")
+	}
+}
+
+type markerLockFailureLayer struct{ ObjectLayer }
+
+func (markerLockFailureLayer) NewNSLock(string, ...string) RWLocker { return markerFailedLock{} }
+
+type markerFailedLock struct{ RWLocker }
+
+func (markerFailedLock) GetLock(context.Context, *dynamicTimeout) (LockContext, error) {
+	return LockContext{}, context.DeadlineExceeded
+}
+
+type markerLookupLayer struct {
+	ObjectLayer
+	mutate   func(ObjectInfo, error) (ObjectInfo, error)
+	lookedUp chan struct{}
+}
+
+func (l markerLookupLayer) GetObjectInfo(ctx context.Context, bucket, object string, opts ObjectOptions) (ObjectInfo, error) {
+	oi, err := l.ObjectLayer.GetObjectInfo(ctx, bucket, object, opts)
+	defer close(l.lookedUp)
+	return l.mutate(oi, err)
+}
+
+func testReplicationMRFInvalidLookups(ctx context.Context, t *testing.T, obj ObjectLayer, p *ReplicationPool, newPool func() *ReplicationPool, d DeletedObjectReplicationInfo) {
+	for _, tc := range []struct {
+		name   string
+		mutate func(ObjectInfo, error) (ObjectInfo, error)
+	}{
+		{"empty-info", func(_ ObjectInfo, e error) (ObjectInfo, error) { return ObjectInfo{}, e }},
+		{"not-a-marker", func(o ObjectInfo, e error) (ObjectInfo, error) { o.DeleteMarker = false; return o, e }},
+		{"wrong-version", func(o ObjectInfo, e error) (ObjectInfo, error) { o.VersionID = mustGetUUID(); return o, e }},
+		{"wrong-bucket", func(o ObjectInfo, e error) (ObjectInfo, error) { o.Bucket = "different-bucket"; return o, e }},
+		{"wrong-object", func(o ObjectInfo, e error) (ObjectInfo, error) { o.Name = "different-object"; return o, e }},
+		{"zero-modtime", func(o ObjectInfo, e error) (ObjectInfo, error) { o.ModTime = time.Time{}; return o, e }},
+		{"missing", func(o ObjectInfo, _ error) (ObjectInfo, error) {
+			return o, ObjectNotFound{Bucket: o.Bucket, Object: o.Name}
+		}},
+		{"read-error", func(o ObjectInfo, _ error) (ObjectInfo, error) { return o, InsufficientReadQuorum{} }},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			entry := d.ToMRFEntry()
+			p.saveMRFEntries(ctx, map[string]MRFReplicateEntry{entry.versionID: entry})
+			fresh := newPool()
+			looked := make(chan struct{})
+			fresh.objLayer = markerLookupLayer{ObjectLayer: obj, mutate: tc.mutate, lookedUp: looked}
+			if err := fresh.queueMRFHeal(); err != nil {
+				t.Fatal(err)
+			}
+			select {
+			case <-looked:
+			case <-time.After(3 * time.Second):
+				t.Fatal("disk MRF entry was not read")
+			}
+			select {
+			case op := <-fresh.workers[0]:
+				t.Fatalf("invalid lookup scheduled %T", op)
+			case <-time.After(100 * time.Millisecond):
+			}
+		})
+	}
+}
+
+// Capture the actual internal audit event through the supported webhook sink.
+func replicationTestAudit(ctx context.Context, t *testing.T, bucket string) (<-chan string, func()) {
+	t.Helper()
+	if len(logger.AuditTargets()) != 0 {
+		t.Fatal("unexpected pre-existing test audit targets")
+	}
+	statuses := make(chan string, 16)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var entry struct {
+			API struct{ Name, Bucket, Status string }
+		}
+		if err := json.NewDecoder(r.Body).Decode(&entry); err != nil {
+			t.Error(err)
+		} else if entry.API.Name == ReplicateDeleteAPI && entry.API.Bucket == bucket {
+			statuses <- entry.API.Status
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	endpoint, err := xnet.ParseHTTPURL(server.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if errs := logger.UpdateAuditWebhooks(ctx, map[string]loghttp.Config{"r6": {Enabled: true, Name: "r6", Endpoint: endpoint, BatchSize: 1, QueueSize: 128, MaxRetry: 1, RetryIntvl: time.Millisecond, HTTPTimeout: time.Second}}); len(errs) > 0 {
+		t.Fatal(errs)
+	}
+	targets := logger.AuditTargets()
+	return statuses, func() {
+		logger.UpdateAuditWebhooks(ctx, nil)
+		for _, target := range targets {
+			target.Cancel()
+		}
+		server.Close()
+	}
+}
+
+type markerPurgeUpdateLayer struct {
+	ObjectLayer
+	t *testing.T
+}
+
+func (l markerPurgeUpdateLayer) DeleteObject(ctx context.Context, bucket, object string, opts ObjectOptions) (ObjectInfo, error) {
+	l.t.Helper()
+	rs := opts.DeleteReplication
+	if rs.ReplicationStatusInternal != "" || rs.Targets != nil || rs.ReplicaStatus != "" || !rs.CompositeReplicationStatus().Empty() {
+		l.t.Fatalf("purge has a nonempty creation update: %+v", rs)
+	}
+	if rs.CompositeVersionPurgeStatus().Empty() {
+		l.t.Fatal("purge update lost its purge status")
+	}
+	return l.ObjectLayer.DeleteObject(ctx, bucket, object, opts)
+}
@@ -0,0 +1,215 @@
+// Copyright (c) 2026 Feng Ruohang
+//
+// This file is part of Silo Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cmd
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/minio/minio-go/v7"
+	"github.com/minio/minio/internal/bucket/replication"
+	xhttp "github.com/minio/minio/internal/http"
+)
+
+// Purge uses the version-delete wire form regardless of the in-memory shape.
+// Creation status, purge status and successful resync markers are independent.
+func TestReplicateDeleteOperationExits(t *testing.T) {
+	for _, shape := range []string{"marker-creation", "legacy-marker-purge", "marker-purge", "object-purge"} {
+		purge := shape != "marker-creation"
+		for _, tc := range []struct {
+			name                 string
+			creation             replication.StatusType
+			priorPurge           VersionPurgeStatusType
+			headCode, deleteCode int
+			headError            string
+			offline, resync      bool
+		}{
+			{name: "pending-success", creation: replication.Pending, priorPurge: replication.VersionPurgePending, headCode: 404, deleteCode: 204},
+			{name: "completed-creation", creation: replication.Completed, priorPurge: replication.VersionPurgePending, headCode: 405, deleteCode: 204},
+			{name: "existing-marker", creation: replication.Pending, priorPurge: replication.VersionPurgePending, headCode: 405, deleteCode: 204},
+			// Use the quorum S3 code without 503, which is classified as backend-down first.
+			{name: "head-read-quorum", creation: replication.Pending, priorPurge: replication.VersionPurgePending, headCode: 400, headError: "SlowDownRead", deleteCode: 204},
+			{name: "replica-creation-status", creation: replication.Replica, priorPurge: replication.VersionPurgeFailed, headCode: 405, deleteCode: 204},
+			{name: "head-unavailable", creation: replication.Pending, priorPurge: replication.VersionPurgePending, headCode: 503, deleteCode: 204},
+			{name: "head-forbidden", creation: replication.Pending, priorPurge: replication.VersionPurgePending, headCode: 403, deleteCode: 204},
+			{name: "delete-forbidden", creation: replication.Pending, priorPurge: replication.VersionPurgePending, headCode: 404, deleteCode: 403},
+			{name: "delete-method-rejected", creation: replication.Pending, priorPurge: replication.VersionPurgePending, headCode: 404, deleteCode: 405},
+			{name: "delete-unavailable", creation: replication.Pending, priorPurge: replication.VersionPurgePending, headCode: 404, deleteCode: 503},
+			{name: "offline", creation: replication.Pending, priorPurge: replication.VersionPurgePending, headCode: 404, deleteCode: 204, offline: true},
+			{name: "retry-failed", creation: replication.Completed, priorPurge: replication.VersionPurgeFailed, headCode: 404, deleteCode: 204},
+			{name: "purge-complete", creation: replication.Pending, priorPurge: replication.VersionPurgeComplete, headCode: 404, deleteCode: 403},
+			{name: "resync-success", creation: replication.Completed, priorPurge: replication.VersionPurgePending, headCode: 405, deleteCode: 204, resync: true},
+			{name: "resync-already-purged", creation: replication.Pending, priorPurge: replication.VersionPurgeComplete, headCode: 404, deleteCode: 403, resync: true},
+			{name: "resync-failure", creation: replication.Completed, priorPurge: replication.VersionPurgePending, headCode: 404, deleteCode: 403, resync: true},
+		} {
+			t.Run(shape+"/"+tc.name, func(t *testing.T) {
+				version := mustGetUUID()
+				var heads, deletes atomic.Int32
+				server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					if r.URL.Query().Get("versionId") != version {
+						t.Errorf("wrong request version: %s", r.URL)
+					}
+					switch r.Method {
+					case http.MethodHead:
+						heads.Add(1)
+						w.Header().Set(xhttp.AmzVersionID, version)
+						w.Header().Set(xhttp.LastModified, time.Now().UTC().Format(http.TimeFormat))
+						if tc.headCode == 405 {
+							w.Header().Set(xhttp.AmzDeleteMarker, "true")
+						}
+						if tc.headError != "" {
+							w.Header().Set("x-minio-error-code", tc.headError)
+						}
+						w.WriteHeader(tc.headCode)
+					case http.MethodDelete:
+						deletes.Add(1)
+						if got := r.Header.Get(xhttp.MinIOSourceDeleteMarker) == "true"; got == purge {
+							t.Errorf("source delete-marker header=%v, purge=%v", got, purge)
+						}
+						w.WriteHeader(tc.deleteCode)
+						if tc.deleteCode != 204 {
+							fmt.Fprintf(w, `<Error><Code>%s</Code><Message>injected rejection</Message></Error>`, map[int]string{403: "AccessDenied", 405: "MethodNotAllowed", 503: "ServiceUnavailable"}[tc.deleteCode])
+						}
+					default:
+						t.Errorf("unexpected method %s", r.Method)
+					}
+				}))
+				defer server.Close()
+				client, err := minio.New(strings.TrimPrefix(server.URL, "http://"), &minio.Options{Region: "us-east-1", MaxRetries: 1})
+				if err != nil {
+					t.Fatal(err)
+				}
+				old := globalBucketTargetSys
+				globalBucketTargetSys = &BucketTargetSys{hc: map[string]epHealth{client.EndpointURL().Host: {Online: !tc.offline}}}
+				defer func() { globalBucketTargetSys = old }()
+				d := DeletedObjectReplicationInfo{Bucket: "source", DeletedObject: DeletedObject{ObjectName: "marker", DeleteMarker: shape != "object-purge"}}
+				if shape == "marker-creation" || shape == "legacy-marker-purge" {
+					d.DeleteMarkerVersionID = version
+				} else {
+					d.VersionID = version
+				}
+				d.ReplicationState.Targets = map[string]replication.StatusType{"arn1": tc.creation}
+				d.ReplicationState.ResetStatusesMap = map[string]string{"arn1": "previous-reset"}
+				if purge {
+					d.ReplicationState.PurgeTargets = map[string]VersionPurgeStatusType{"arn1": tc.priorPurge}
+				}
+				if tc.resync {
+					d.OpType = replication.ExistingObjectReplicationType
+				}
+				got := replicateDeleteToTarget(t.Context(), d, &TargetClient{Client: client, ARN: "arn1", Bucket: "target", ResetID: "current-reset"})
+				var wantCreation replication.StatusType
+				var wantPurge VersionPurgeStatusType
+				var wantHeads, wantDeletes int32
+				success := false
+				if purge {
+					wantCreation = ""
+					wantPurge = replication.VersionPurgeComplete
+					switch {
+					case tc.priorPurge == replication.VersionPurgeComplete:
+						success = true
+					case tc.offline:
+						wantPurge = replication.VersionPurgeFailed
+					default:
+						wantDeletes = 1
+						success = tc.deleteCode == 204
+						if !success {
+							wantPurge = replication.VersionPurgeFailed
+						}
+					}
+				} else {
+					switch {
+					case tc.creation == replication.Completed && !tc.resync:
+						success = true
+					case tc.offline:
+					default:
+						wantHeads = 1
+						switch tc.headCode {
+						case 405:
+							success = true
+						case 403, 503:
+						default:
+							wantDeletes = 1
+							success = tc.deleteCode == 204
+						}
+					}
+					if success {
+						wantCreation = replication.Completed
+					} else {
+						wantCreation = replication.Failed
+					}
+				}
+				if got.PrevReplicationStatus != tc.creation {
+					t.Error("previous creation state changed")
+				}
+				if got.ReplicationStatus != wantCreation || got.VersionPurgeStatus != wantPurge {
+					t.Errorf("status=%+v, want creation=%s purge=%s", got, wantCreation, wantPurge)
+				}
+				if heads.Load() != wantHeads || deletes.Load() != wantDeletes {
+					t.Errorf("HEAD/DELETE=%d/%d, want %d/%d", heads.Load(), deletes.Load(), wantHeads, wantDeletes)
+				}
+				if (got.Err != nil) == success {
+					t.Errorf("success=%v, error=%v", success, got.Err)
+				}
+				if tc.resync && success {
+					if !strings.HasSuffix(got.ResyncTimestamp, ";current-reset") {
+						t.Errorf("successful resync missing reset: %q", got.ResyncTimestamp)
+					}
+				} else if got.ResyncTimestamp != "previous-reset" {
+					t.Errorf("unexpected reset: %q", got.ResyncTimestamp)
+				}
+			})
+		}
+	}
+}
+
+func TestReplicateDeletePurgeMissingTargetState(t *testing.T) {
+	// Classification belongs to the operation, even if this target has no
+	// previous purge entry (another target supplies the tracked purge state).
+	var deletes atomic.Int32
+	version := mustGetUUID()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodDelete || r.URL.Query().Get("versionId") != version || r.Header.Get(xhttp.MinIOSourceDeleteMarker) == "true" {
+			t.Errorf("wrong purge request: %s %s %v", r.Method, r.URL, r.Header)
+		}
+		deletes.Add(1)
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer server.Close()
+	client, err := minio.New(strings.TrimPrefix(server.URL, "http://"), &minio.Options{Region: "us-east-1", MaxRetries: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	old := globalBucketTargetSys
+	globalBucketTargetSys = &BucketTargetSys{hc: map[string]epHealth{client.EndpointURL().Host: {Online: true}}}
+	defer func() { globalBucketTargetSys = old }()
+	d := DeletedObjectReplicationInfo{Bucket: "source", DeletedObject: DeletedObject{ObjectName: "marker", DeleteMarker: true, DeleteMarkerVersionID: version, ReplicationState: ReplicationState{Targets: map[string]replication.StatusType{"arn1": replication.Completed}, PurgeTargets: map[string]VersionPurgeStatusType{"arn2": replication.VersionPurgePending}}}}
+	got := replicateDeleteToTarget(t.Context(), d, &TargetClient{Client: client, ARN: "arn1", Bucket: "target", ResetID: "reset"})
+	if deletes.Load() != 1 || got.VersionPurgeStatus != replication.VersionPurgeComplete || got.ReplicationStatus != "" {
+		t.Fatalf("operation misclassified: %+v, deletes=%d", got, deletes.Load())
+	}
+	got.ResyncTimestamp = "resync;reset"
+	state := getReplicationState(replicatedInfos{Targets: []replicatedTargetInfo{got}}, ReplicationState{}, "")
+	if state.ResetStatusesMap[targetResetHeader("arn1")] != got.ResyncTimestamp {
+		t.Fatal("resync timestamp not preserved with nil reset map")
+	}
+}
@@ -0,0 +1,599 @@
+// Copyright (c) 2026 Feng Ruohang
+//
+// This file is part of Silo Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cmd
+
+import (
+	"context"
+	"encoding/xml"
+	"fmt"
+	"maps"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/minio/minio-go/v7"
+	"github.com/minio/minio/internal/auth"
+	"github.com/minio/minio/internal/bucket/replication"
+	xhttp "github.com/minio/minio/internal/http"
+	"github.com/minio/minio/internal/kms"
+)
+
+const r5TagStamp = ReservedMetadataPrefixLower + TaggingTimestamp
+
+func r5Capacity(z *erasureServerPools) func() {
+	var restores []func()
+	for _, pool := range z.serverPools {
+		for _, set := range pool.sets {
+			old := set.getDisks
+			disks := append([]StorageAPI(nil), old()...)
+			for i := range disks {
+				disks[i] = tagTestCapacityDisk{StorageAPI: disks[i]}
+			}
+			set.getDisks = func() []StorageAPI { return disks }
+			restores = append(restores, func() { set.getDisks = old })
+		}
+	}
+	return func() {
+		for _, restore := range restores {
+			restore()
+		}
+	}
+}
+
+func r5Request(t *testing.T, router http.Handler, cred auth.Credentials, method, path, body string, headers map[string]string) *httptest.ResponseRecorder {
+	t.Helper()
+	r, err := newTestSignedRequestV4(method, path, int64(len(body)), strings.NewReader(body), cred.AccessKey, cred.SecretKey, headers)
+	if err != nil {
+		t.Fatal(err)
+	}
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, r)
+	return w
+}
+
+func r5Stored(t *testing.T, obj interface {
+	GetObjectInfo(context.Context, string, string, ObjectOptions) (ObjectInfo, error)
+}, bucket, name, vid, wantTags, wantStamp string,
+) ObjectInfo {
+	t.Helper()
+	oi, err := obj.GetObjectInfo(t.Context(), bucket, name, ObjectOptions{VersionID: vid})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if oi.UserTags != wantTags || oi.UserDefined[r5TagStamp] != wantStamp {
+		t.Fatalf("%s(%s): tags=%q stamp=%q, want %q %q", name, vid, oi.UserTags, oi.UserDefined[r5TagStamp], wantTags, wantStamp)
+	}
+	return oi
+}
+
+// The request bytes are signed and enter the real API and storage implementation.
+// Equal/stale retransmits may retain the existing 412 duplicate response.
+func r5Receive(t *testing.T, obj ObjectLayer, router http.Handler, cred auth.Credentials, bucket, operation string, source ObjectInfo, stamp string, afterInit func()) {
+	t.Helper()
+	opts, _, err := putReplicationOpts(t.Context(), "", source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if operation == "multipart" {
+		opts.Internal.SourceMTime = time.Time{}
+	}
+	headers := make(map[string]string)
+	for k, vs := range opts.Header() {
+		if len(vs) > 0 {
+			headers[k] = vs[0]
+		}
+	}
+	if stamp == "" {
+		delete(headers, http.CanonicalHeaderKey(xhttp.MinIOSourceTaggingTimestamp))
+		delete(headers, xhttp.MinIOSourceTaggingTimestamp)
+	} else {
+		headers[http.CanonicalHeaderKey(xhttp.MinIOSourceTaggingTimestamp)] = stamp
+	}
+	path := "/" + bucket + "/" + source.Name + "?versionId=" + source.VersionID
+	var w *httptest.ResponseRecorder
+	switch operation {
+	case "copy", "copy-default":
+		maps.Copy(headers, getCopyObjMetadata(source, ""))
+		headers[xhttp.AmzCopySource] = "/" + bucket + "/" + source.Name + "?versionId=" + source.VersionID
+		if operation == "copy" {
+			headers[xhttp.AmzMetadataDirective] = "REPLACE"
+		}
+		w = r5Request(t, router, cred, http.MethodPut, path, "", headers)
+	case "put":
+		w = r5Request(t, router, cred, http.MethodPut, path, "data", headers)
+	case "multipart":
+		w = r5Request(t, router, cred, http.MethodPost, path+"&uploads", "", headers)
+		if w.Code == http.StatusPreconditionFailed {
+			return
+		}
+		if w.Code != http.StatusOK {
+			t.Fatalf("init: %d %s", w.Code, w.Body.String())
+		}
+		var init struct {
+			UploadID string `xml:"UploadId"`
+		}
+		if err := xml.Unmarshal(w.Body.Bytes(), &init); err != nil || init.UploadID == "" {
+			t.Fatalf("init XML: %v %s", err, w.Body.String())
+		}
+		mi, err := obj.GetMultipartInfo(t.Context(), bucket, source.Name, init.UploadID, ObjectOptions{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if stamp != "" && mi.UserDefined[r5TagStamp] != stamp {
+			t.Fatalf("upload persisted stamp=%q, want %q", mi.UserDefined[r5TagStamp], stamp)
+		}
+		partPath := "/" + bucket + "/" + source.Name + "?uploadId=" + url.QueryEscape(init.UploadID)
+		ph := map[string]string{xhttp.MinIOSourceReplicationRequest: "true"}
+		part := r5Request(t, router, cred, http.MethodPut, partPath+"&partNumber=1", "data", ph)
+		if part.Code != http.StatusOK {
+			t.Fatalf("part: %d %s", part.Code, part.Body.String())
+		}
+		if afterInit != nil {
+			afterInit()
+		}
+		body := "<CompleteMultipartUpload><Part><PartNumber>1</PartNumber><ETag>" + canonicalizeETag(part.Header()[xhttp.ETag][0]) + "</ETag></Part></CompleteMultipartUpload>"
+		ph[xhttp.MinIOSourceMTime] = source.ModTime.Format(time.RFC3339Nano)
+		ph[xhttp.MinIOSourceETag] = source.ETag
+		w = r5Request(t, router, cred, http.MethodPost, partPath, body, ph)
+	}
+	if w.Code != http.StatusOK && w.Code != http.StatusPreconditionFailed {
+		t.Fatalf("%s: %d %s", operation, w.Code, w.Body.String())
+	}
+}
+
+func TestAPITaggingReplicationOrdering(t *testing.T)    { r5APIOrdering(t, false) }
+func TestAPITaggingReplicationOrderingKMS(t *testing.T) { r5APIOrdering(t, true) }
+func r5APIOrdering(t *testing.T, encrypted bool) {
+	ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{t: t, objAPITest: func(obj ObjectLayer, instance, bucket string, router http.Handler, cred auth.Credentials, t *testing.T) {
+		defer r5Capacity(obj.(*erasureServerPools))()
+		if _, err := globalBucketMetadataSys.Update(t.Context(), bucket, bucketVersioningConfig, enabledBucketVersioningConfig); err != nil {
+			t.Fatal(err)
+		}
+		if encrypted {
+			prev := GlobalKMS
+			GlobalKMS = kms.NewStub("r5-tag-order")
+			defer func() { GlobalKMS = prev }()
+			sse := []byte(`<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>aws:kms</SSEAlgorithm><KMSMasterKeyID>r5-tag-order</KMSMasterKeyID></ApplyServerSideEncryptionByDefault></Rule></ServerSideEncryptionConfiguration>`)
+			if _, err := globalBucketMetadataSys.Update(t.Context(), bucket, bucketSSEConfig, sse); err != nil {
+				t.Fatal(err)
+			}
+		}
+		base := time.Now().UTC().Add(-5 * time.Hour)
+		for _, op := range []string{"copy", "copy-default", "put", "multipart"} {
+			for _, version := range []string{"uuid", "null"} {
+				t.Run(instance+"/"+op+"/"+version, func(t *testing.T) {
+					name := op + "-" + version
+					vid := mustGetUUID()
+					if version == "null" {
+						vid = nullVersionID
+					}
+					original, err := obj.PutObject(t.Context(), bucket, name, mustGetPutObjReader(t, strings.NewReader("data"), 4, "", ""), ObjectOptions{Versioned: true, VersionID: vid, UserDefined: map[string]string{xhttp.AmzObjectTagging: "key=original", r5TagStamp: base.Format(time.RFC3339Nano)}})
+					if err != nil {
+						t.Fatal(err)
+					}
+					if op == "multipart" {
+						// The production sender uses multipart only for multipart
+						// sources. Preserve a real multipart ETag and part layout.
+						metadata := maps.Clone(original.UserDefined)
+						metadata[xhttp.AmzObjectTagging] = original.UserTags
+						mp, err := obj.NewMultipartUpload(t.Context(), bucket, name, ObjectOptions{Versioned: true, VersionID: vid, UserDefined: metadata})
+						if err != nil {
+							t.Fatal(err)
+						}
+						part, err := obj.PutObjectPart(t.Context(), bucket, name, mp.UploadID, 1, mustGetPutObjReader(t, strings.NewReader("data"), 4, "", ""), ObjectOptions{})
+						if err != nil {
+							t.Fatal(err)
+						}
+						original, err = obj.CompleteMultipartUpload(t.Context(), bucket, name, mp.UploadID, []CompletePart{{PartNumber: 1, ETag: part.ETag}}, ObjectOptions{Versioned: true})
+						if err != nil {
+							t.Fatal(err)
+						}
+					}
+					// A later unrelated version must not contribute tags to an explicitly addressed UUID/null version.
+					latest, err := obj.PutObject(t.Context(), bucket, name, mustGetPutObjReader(t, strings.NewReader("other"), 5, "", ""), ObjectOptions{Versioned: true, UserDefined: map[string]string{xhttp.AmzObjectTagging: "key=latest", r5TagStamp: base.Add(10 * time.Hour).Format(time.RFC3339Nano)}})
+					if err != nil {
+						t.Fatal(err)
+					}
+					for _, event := range []struct {
+						name, tags string
+						hours      int
+						wantTags   string
+						wantHours  int
+					}{
+						{"delete", "", 3, "", 3}, {"stale", "key=stale", 2, "", 3}, {"equal-conflict", "key=conflict", 3, "", 3}, {"newer", "key=new", 4, "key=new", 4},
+					} {
+						t.Run(event.name, func(t *testing.T) {
+							source := original
+							source.VersionID = vid
+							source.UserDefined = maps.Clone(original.UserDefined)
+							source.UserTags = event.tags
+							stamp := base.Add(time.Duration(event.hours) * time.Hour).Format(time.RFC3339Nano)
+							source.UserDefined[r5TagStamp] = stamp
+							r5Receive(t, obj, router, cred, bucket, op, source, stamp, nil)
+							r5Stored(t, obj, bucket, name, vid, event.wantTags, base.Add(time.Duration(event.wantHours)*time.Hour).Format(time.RFC3339Nano))
+							r5Stored(t, obj, bucket, name, latest.VersionID, "key=latest", base.Add(10*time.Hour).Format(time.RFC3339Nano))
+						})
+					}
+					source := original
+					source.VersionID = vid
+					source.UserTags = "key=unversioned-event"
+					r5Receive(t, obj, router, cred, bucket, op, source, "", nil)
+					r5Stored(t, obj, bucket, name, vid, "key=new", base.Add(4*time.Hour).Format(time.RFC3339Nano))
+					get := r5Request(t, router, cred, http.MethodGet, "/"+bucket+"/"+name+"?versionId="+vid, "", nil)
+					if get.Code != http.StatusOK || get.Body.String() != "data" {
+						t.Fatalf("plaintext GET: %d %q", get.Code, get.Body.String())
+					}
+				})
+			}
+		}
+	}})
+}
+
+func TestAPITaggingMultipartCommitRechecksRevision(t *testing.T) {
+	ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{t: t, objAPITest: func(obj ObjectLayer, instance, bucket string, router http.Handler, cred auth.Credentials, t *testing.T) {
+		defer r5Capacity(obj.(*erasureServerPools))()
+		if _, err := globalBucketMetadataSys.Update(t.Context(), bucket, bucketVersioningConfig, enabledBucketVersioningConfig); err != nil {
+			t.Fatal(err)
+		}
+		base := time.Now().UTC().Add(-time.Hour)
+		source := ObjectInfo{Name: "commit-recheck", VersionID: mustGetUUID(), ModTime: base, UserTags: "key=incoming", UserDefined: map[string]string{r5TagStamp: base.Format(time.RFC3339Nano)}}
+		later := base.Add(time.Minute).Format(time.RFC3339Nano)
+		r5Receive(t, obj, router, cred, bucket, "multipart", source, base.Format(time.RFC3339Nano), func() {
+			_, err := obj.PutObject(t.Context(), bucket, source.Name, mustGetPutObjReader(t, strings.NewReader("data"), 4, "", ""), ObjectOptions{Versioned: true, VersionID: source.VersionID, MTime: base, UserDefined: map[string]string{r5TagStamp: later}})
+			if err != nil {
+				t.Fatal(err)
+			}
+		})
+		r5Stored(t, obj, bucket, source.Name, source.VersionID, "", later)
+		t.Logf("%s: deletion committed between initiation and completion survived", instance)
+	}})
+}
+
+func TestAPILocalTaggingAlwaysAdvancesRevision(t *testing.T) {
+	ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{t: t, objAPITest: func(obj ObjectLayer, instance, bucket string, router http.Handler, cred auth.Credentials, t *testing.T) {
+		defer r5Capacity(obj.(*erasureServerPools))()
+		if _, err := globalBucketMetadataSys.Update(t.Context(), bucket, bucketVersioningConfig, enabledBucketVersioningConfig); err != nil {
+			t.Fatal(err)
+		}
+		oi, err := obj.PutObject(t.Context(), bucket, "local-tags", mustGetPutObjReader(t, strings.NewReader("data"), 4, "", ""), ObjectOptions{Versioned: true})
+		if err != nil {
+			t.Fatal(err)
+		}
+		path := "/" + bucket + "/local-tags?tagging&versionId=" + oi.VersionID
+		for n, method := range []string{http.MethodPut, http.MethodDelete, http.MethodDelete, http.MethodPut} {
+			body := ""
+			want := ""
+			status := http.StatusNoContent
+			if method == http.MethodPut {
+				status = http.StatusOK
+				body = "<Tagging><TagSet/></Tagging>"
+				if n == 0 {
+					want = "key=local"
+					body = "<Tagging><TagSet><Tag><Key>key</Key><Value>local</Value></Tag></TagSet></Tagging>"
+				}
+			}
+			before := time.Now().UTC()
+			w := r5Request(t, router, cred, method, path, body, nil)
+			if w.Code != status {
+				t.Fatalf("%s: %d %s", method, w.Code, w.Body.String())
+			}
+			now, err := obj.GetObjectInfo(t.Context(), bucket, "local-tags", ObjectOptions{VersionID: oi.VersionID})
+			if err != nil {
+				t.Fatal(err)
+			}
+			stamp, err := time.Parse(time.RFC3339Nano, now.UserDefined[r5TagStamp])
+			if err != nil || stamp.Before(before) || now.UserTags != want {
+				t.Fatalf("local %s: tags=%q timestamp=%q err=%v", method, now.UserTags, now.UserDefined[r5TagStamp], err)
+			}
+			if !now.ModTime.Equal(oi.ModTime) {
+				t.Fatal("tagging changed the object's data modification time")
+			}
+			t.Logf("%s mutation %d persisted tags=%q timestamp=%s", instance, n, now.UserTags, stamp)
+		}
+		// Ordinary COPY with empty REPLACE has the same local-deletion semantics.
+		before := time.Now().UTC()
+		headers := map[string]string{xhttp.AmzCopySource: "/" + bucket + "/local-tags?versionId=" + oi.VersionID, xhttp.AmzMetadataDirective: "REPLACE", xhttp.AmzTagDirective: "REPLACE"}
+		w := r5Request(t, router, cred, http.MethodPut, "/"+bucket+"/copied-empty", "", headers)
+		if w.Code != http.StatusOK {
+			t.Fatalf("copy: %d %s", w.Code, w.Body.String())
+		}
+		copied, err := obj.GetObjectInfo(t.Context(), bucket, "copied-empty", ObjectOptions{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		stamp, err := time.Parse(time.RFC3339Nano, copied.UserDefined[r5TagStamp])
+		if err != nil || stamp.Before(before) || copied.UserTags != "" {
+			t.Fatalf("local COPY: %v %+v", err, copied)
+		}
+	}})
+}
+
+func TestTaggingTimestampWire(t *testing.T) {
+	now := time.Now().UTC()
+	for _, tag := range []string{"", "key=value"} {
+		for _, stamp := range []string{"", now.Format(time.RFC3339Nano), "invalid"} {
+			t.Run(fmt.Sprintf("%s/%s", tag, stamp), func(t *testing.T) {
+				source := ObjectInfo{ModTime: now.Add(-time.Hour), UserTags: tag, UserDefined: map[string]string{}}
+				if stamp != "" {
+					source.UserDefined[r5TagStamp] = stamp
+				}
+				opts, _, err := putReplicationOpts(t.Context(), "", source)
+				if stamp == "invalid" {
+					if err == nil {
+						t.Fatal("invalid timestamp accepted")
+					}
+					return
+				}
+				if err != nil {
+					t.Fatal(err)
+				}
+				want := stamp
+				if want == "" && tag != "" {
+					want = source.ModTime.Format(time.RFC3339Nano)
+				}
+				if got := opts.Header().Get(xhttp.MinIOSourceTaggingTimestamp); got != want {
+					t.Fatalf("wire timestamp=%q want %q", got, want)
+				}
+			})
+		}
+	}
+}
+
+func TestAPIPoolsTaggingReplicaDeletion(t *testing.T) {
+	z, bucket := consistencyPools(t)
+	defer r5Capacity(z)()
+	if err := newTestConfig(globalMinioDefaultRegion, z); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := globalBucketMetadataSys.Update(t.Context(), bucket, bucketVersioningConfig, enabledBucketVersioningConfig); err != nil {
+		t.Fatal(err)
+	}
+	router := initTestAPIEndPoints(z, nil)
+	base := time.Now().UTC().Add(-5 * time.Hour)
+	for _, op := range []string{"copy", "copy-default", "put", "multipart"} {
+		for _, kind := range []string{"uuid", "null"} {
+			t.Run(op+"/"+kind, func(t *testing.T) {
+				vid := mustGetUUID()
+				if kind == "null" {
+					vid = nullVersionID
+				}
+				name := "pool-tags-" + op + "-" + kind
+				var source ObjectInfo
+				for pool := range 2 {
+					tag := "key=stale-pool"
+					ts := base
+					if pool == 1 {
+						tag = ""
+						ts = base.Add(3 * time.Hour)
+					}
+					source = putConsistencyObject(t, z, bucket, name, pool, "data", ObjectOptions{Versioned: true, VersionID: vid, MTime: base, UserDefined: map[string]string{xhttp.AmzObjectTagging: tag, r5TagStamp: ts.Format(time.RFC3339Nano)}})
+				}
+				// Clear all copies through the signed local handler, then replay a stale incoming state.
+				req := r5Request(t, router, globalActiveCred, http.MethodDelete, "/"+bucket+"/"+name+"?tagging&versionId="+vid, "", nil)
+				if req.Code != http.StatusNoContent {
+					t.Fatalf("DELETE: %d %s", req.Code, req.Body.String())
+				}
+				current, err := z.GetObjectInfo(t.Context(), bucket, name, ObjectOptions{VersionID: vid})
+				if err != nil {
+					t.Fatal(err)
+				}
+				deletedAt := current.UserDefined[r5TagStamp]
+				for pool := range 2 {
+					r5Stored(t, z.serverPools[pool], bucket, name, vid, "", deletedAt)
+				}
+				source.VersionID = vid
+				source.UserTags = "key=delayed"
+				source.UserDefined = map[string]string{r5TagStamp: base.Add(time.Hour).Format(time.RFC3339Nano)}
+				r5Receive(t, z, router, globalActiveCred, bucket, op, source, source.UserDefined[r5TagStamp], nil)
+				// The addressed version must remain readable through normal routing.
+				r5Stored(t, z, bucket, name, vid, "", deletedAt)
+				// Existing duplicate suppression may leave both identical tombstones; any retained copy must be correct.
+				for pool := range 2 {
+					got, err := z.serverPools[pool].GetObjectInfo(t.Context(), bucket, name, ObjectOptions{VersionID: vid})
+					if isErrVersionNotFound(err) {
+						continue
+					}
+					if err != nil {
+						t.Fatal(err)
+					}
+					if got.UserTags != "" || got.UserDefined[r5TagStamp] != deletedAt {
+						t.Fatalf("pool %d: tags=%q stamp=%q want deletion %q", pool, got.UserTags, got.UserDefined[r5TagStamp], deletedAt)
+					}
+				}
+			})
+		}
+	}
+}
+
+func TestAPITaggingSSECRotationPreservesDeletionRevision(t *testing.T) {
+	ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{t: t, objAPITest: func(obj ObjectLayer, instance, bucket string, router http.Handler, cred auth.Credentials, t *testing.T) {
+		defer r5Capacity(obj.(*erasureServerPools))()
+		oldTLS := globalIsTLS
+		globalIsTLS = true
+		defer func() { globalIsTLS = oldTLS }()
+		if _, err := globalBucketMetadataSys.Update(t.Context(), bucket, bucketVersioningConfig, enabledBucketVersioningConfig); err != nil {
+			t.Fatal(err)
+		}
+		keys := [][]byte{[]byte(strings.Repeat("a", 32)), []byte(strings.Repeat("b", 32)), []byte(strings.Repeat("c", 32)), []byte(strings.Repeat("d", 32))}
+		const name = "tag-rotation"
+		putCopyChecksumSource(t, router, cred, bucket, name, []byte("data"), ssecKeyHeaders(keys[0], false))
+		oi, err := obj.GetObjectInfo(t.Context(), bucket, name, ObjectOptions{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		base := time.Now().UTC().Add(-time.Hour)
+		for i, event := range []struct {
+			tags      string
+			delta     int
+			wantTags  string
+			wantDelta int
+		}{
+			{"key=live", 1, "key=live", 1}, {"", 3, "", 3}, {"key=stale", 2, "", 3},
+		} {
+			h := ssecKeyHeaders(keys[i], true)
+			maps.Copy(h, ssecKeyHeaders(keys[i+1], false))
+			h[xhttp.AmzObjectTagging] = event.tags
+			h[xhttp.AmzTagDirective] = "REPLACE"
+			h[xhttp.MinIOSourceTaggingTimestamp] = base.Add(time.Duration(event.delta) * time.Minute).Format(time.RFC3339Nano)
+			sendReplicaLockCopy(t, router, cred, bucket, name, oi.VersionID, h)
+			r5Stored(t, obj, bucket, name, oi.VersionID, event.wantTags, base.Add(time.Duration(event.wantDelta)*time.Minute).Format(time.RFC3339Nano))
+		}
+		get := r5Request(t, router, cred, http.MethodGet, "/"+bucket+"/"+name+"?versionId="+oi.VersionID, "", ssecKeyHeaders(keys[3], false))
+		if get.Code != http.StatusOK || get.Body.String() != "data" {
+			t.Fatalf("%s GET after rotations: %d %q", instance, get.Code, get.Body.String())
+		}
+	}})
+}
+
+func TestTaggingRepeatedValueNeedsRevisionDelivery(t *testing.T) {
+	for _, tag := range []string{"", "key=same"} {
+		now := time.Now().UTC()
+		source := ObjectInfo{ModTime: now, UserTags: tag, UserDefined: map[string]string{r5TagStamp: now.Add(time.Hour).Format(time.RFC3339Nano)}}
+		target := minio.ObjectInfo{LastModified: now}
+		if tag != "" {
+			target.UserTags = map[string]string{"key": "same"}
+			target.UserTagCount = 1
+		}
+		if got := getReplicationAction(source, target, replication.MetadataReplicationType); got != replicateMetadata {
+			t.Errorf("equal tags %q suppress a newer revision: got %s; an intervening delayed deletion can win", tag, got)
+		}
+	}
+}
+
+func TestTaggingProductionCopyWireShape(t *testing.T) {
+	got := make(chan http.Header, 1)
+	peer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		got <- r.Header.Clone()
+		w.Header().Set(xhttp.ContentType, "application/xml")
+		w.Write([]byte(`<CopyObjectResult><LastModified>2026-09-15T01:00:00Z</LastModified><ETag>"abc"</ETag></CopyObjectResult>`))
+	}))
+	defer peer.Close()
+	c, err := minio.New(strings.TrimPrefix(peer.URL, "http://"), &minio.Options{Region: "us-east-1", MaxRetries: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC()
+	oi := ObjectInfo{Name: "object", ModTime: now, ETag: "abc", VersionID: mustGetUUID()}
+	core := minio.Core{Client: c}
+	_, err = core.CopyObject(t.Context(), "bucket", "object", "bucket", "object", getCopyObjMetadata(oi, ""), minio.CopySrcOptions{VersionID: oi.VersionID}, minio.PutObjectOptions{Internal: minio.AdvancedPutOptions{SourceVersionID: oi.VersionID, ReplicationRequest: true, TaggingTimestamp: now}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	h := <-got
+	t.Logf("SDK wire: metadata-directive=%q tagging-directive=%q tagging=%q time=%q", h.Get(xhttp.AmzMetadataDirective), h.Get(xhttp.AmzTagDirective), h.Get(xhttp.AmzObjectTagging), h.Get(xhttp.MinIOSourceTaggingTimestamp))
+	if h.Get(xhttp.AmzMetadataDirective) != "" || h.Get(xhttp.AmzTagDirective) != "REPLACE" || h.Get(xhttp.MinIOSourceTaggingTimestamp) != now.Format(time.RFC3339Nano) {
+		t.Fatalf("unexpected SDK wire: %v", h)
+	}
+}
+
+func TestLocalTaggingCommitCannotRegressRevision(t *testing.T) {
+	z, bucket := consistencyPools(t)
+	incoming := "2026-09-15T01:00:00Z"
+	newer := "2026-09-15T02:00:00Z"
+	newest := "2026-09-15T03:00:00Z"
+	vid := mustGetUUID()
+	name := "inverted-local-tags"
+	for pool := range 2 {
+		putConsistencyObject(t, z, bucket, name, pool, "data", ObjectOptions{Versioned: true, VersionID: vid, UserDefined: map[string]string{r5TagStamp: []string{newer, newest}[pool]}})
+	}
+	oi, err := z.PutObjectTags(t.Context(), bucket, name, "key=after-delete", ObjectOptions{VersionID: vid, UserDefined: map[string]string{r5TagStamp: incoming}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := "2026-09-15T03:00:00.000000001Z"
+	for pool := range 2 {
+		r5Stored(t, z.serverPools[pool], bucket, name, vid, "key=after-delete", want)
+	}
+	if oi.UserDefined[r5TagStamp] != want {
+		t.Fatalf("response stamp=%q want %q", oi.UserDefined[r5TagStamp], want)
+	}
+	// The single-set guard also applies when the pools dispatcher is bypassed.
+	_, err = z.serverPools[0].PutObjectTags(t.Context(), bucket, name, "", ObjectOptions{VersionID: vid, UserDefined: map[string]string{r5TagStamp: incoming}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r5Stored(t, z.serverPools[0], bucket, name, vid, "", "2026-09-15T03:00:00.000000002Z")
+}
+
+func TestTaggingReplicaContentDuplicateGuard(t *testing.T) {
+	stamp := time.Date(2026, 9, 15, 1, 0, 0, 0, time.UTC)
+	for _, tc := range []struct {
+		name             string
+		delta            int
+		stored           string
+		trusted, replica bool
+		ifMatch, ifNone  string
+		wantSkip         bool
+	}{
+		{name: "newer", delta: 1, trusted: true, replica: true},
+		{name: "equal", trusted: true, replica: true, wantSkip: true},
+		{name: "older", delta: -1, trusted: true, replica: true, wantSkip: true},
+		{name: "invalid-stored", stored: "invalid", delta: 1, trusted: true, replica: true},
+		{name: "untrusted", delta: 1, wantSkip: true},
+		{name: "marker-only", delta: 1, trusted: true, wantSkip: true},
+		{name: "if-match-fails", delta: 1, trusted: true, replica: true, ifMatch: "other", wantSkip: true},
+		{name: "if-none-match-fails", delta: 1, trusted: true, replica: true, ifNone: "etag", wantSkip: true},
+		{name: "if-match-passes", delta: 1, trusted: true, replica: true, ifMatch: "etag"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := withReplicationTrust(t.Context(), tc.trusted, tc.replica)
+			r := httptest.NewRequest(http.MethodPut, "/bucket/object", nil).WithContext(ctx)
+			if tc.ifMatch != "" {
+				r.Header.Set(xhttp.IfMatch, tc.ifMatch)
+			}
+			if tc.ifNone != "" {
+				r.Header.Set(xhttp.IfNoneMatch, tc.ifNone)
+			}
+			stored := tc.stored
+			if stored == "" {
+				stored = stamp.Format(time.RFC3339Nano)
+			}
+			oi := ObjectInfo{ModTime: stamp, VersionID: mustGetUUID(), ETag: "etag", UserDefined: map[string]string{r5TagStamp: stored}}
+			opts := ObjectOptions{VersionID: oi.VersionID, PreserveETag: oi.ETag, ReplicationRequest: tc.trusted, ReplicationSourceTaggingTimestamp: stamp.Add(time.Duration(tc.delta) * time.Second)}
+			if skip := checkPreconditionsPUT(ctx, httptest.NewRecorder(), r, oi, opts); skip != tc.wantSkip {
+				t.Fatalf("skip=%v, want %v", skip, tc.wantSkip)
+			}
+		})
+	}
+}
+
+func TestAPITaggingUnqualifiedCopyOrdering(t *testing.T) {
+	ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{t: t, objAPITest: func(obj ObjectLayer, instance, bucket string, router http.Handler, cred auth.Credentials, t *testing.T) {
+		defer r5Capacity(obj.(*erasureServerPools))()
+		stamp := time.Now().UTC().Add(-time.Hour)
+		oi, err := obj.PutObject(t.Context(), bucket, "unqualified-tags", mustGetPutObjReader(t, strings.NewReader("data"), 4, "", ""), ObjectOptions{UserDefined: map[string]string{xhttp.AmzObjectTagging: "key=stored", r5TagStamp: stamp.Format(time.RFC3339Nano)}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		source := oi
+		source.UserTags = ""
+		source.UserDefined = maps.Clone(oi.UserDefined)
+		r5Receive(t, obj, router, cred, bucket, "copy", source, stamp.Format(time.RFC3339Nano), nil)
+		r5Stored(t, obj, bucket, oi.Name, "", "key=stored", stamp.Format(time.RFC3339Nano))
+		later := stamp.Add(time.Minute).Format(time.RFC3339Nano)
+		r5Receive(t, obj, router, cred, bucket, "copy-default", source, later, nil)
+		r5Stored(t, obj, bucket, oi.Name, "", "", later)
+		source.UserTags = "key=delayed"
+		r5Receive(t, obj, router, cred, bucket, "copy-default", source, stamp.Format(time.RFC3339Nano), nil)
+		r5Stored(t, obj, bucket, oi.Name, "", "", later)
+		t.Logf("%s: unqualified COPY keeps stored ties and ordered deletion", instance)
+	}})
+}
@@ -0,0 +1,154 @@
+// Copyright (c) 2026 Feng Ruohang
+//
+// This file is part of Silo Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cmd
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/minio/madmin-go/v3"
+	"github.com/minio/minio-go/v7"
+	"github.com/minio/minio/internal/auth"
+	"github.com/minio/minio/internal/bucket/replication"
+	xhttp "github.com/minio/minio/internal/http"
+	"github.com/minio/minio/internal/once"
+)
+
+func r5ReplicationFixture(t *testing.T, obj ObjectLayer, bucket string, client *minio.Client) (chan ReplicationWorkerOperation, func()) {
+	t.Helper()
+	const arn = "arn:minio:replication::af470089-d354-4473-934c-9e1f52f6da89:bucket"
+	target := &TargetClient{Client: client, ARN: arn, Bucket: bucket}
+	globalBucketTargetSys.arnRemotesMap[arn] = arnTarget{Client: target, lastRefresh: UTCNow()}
+	globalBucketTargetSys.targetsMap[bucket] = []madmin.BucketTarget{{Arn: arn, TargetBucket: bucket}}
+	meta, err := globalBucketMetadataSys.Get(bucket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	cfg := configs[0]
+	cfg.RoleArn = arn
+	meta.replicationConfig = &cfg
+	globalBucketMetadataSys.Set(bucket, meta)
+	worker := make(chan ReplicationWorkerOperation, 10)
+	previous := globalReplicationPool
+	globalReplicationPool = once.NewSingleton[ReplicationPool]()
+	globalReplicationPool.Set(&ReplicationPool{ctx: t.Context(), objLayer: obj, workers: []chan ReplicationWorkerOperation{worker}, stats: globalReplicationStats.Load(), mrfSaveCh: make(chan MRFReplicateEntry, 10)})
+	return worker, func() { globalReplicationPool = previous }
+}
+
+func TestTaggingReplicationSenderRetryAndAcknowledgment(t *testing.T) {
+	ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{t: t, objAPITest: func(obj ObjectLayer, instance, bucket string, router http.Handler, cred auth.Credentials, t *testing.T) {
+		defer r5Capacity(obj.(*erasureServerPools))()
+		if _, err := globalBucketMetadataSys.Update(t.Context(), bucket, bucketVersioningConfig, enabledBucketVersioningConfig); err != nil {
+			t.Fatal(err)
+		}
+		const name = "tagging-old-queue"
+		oi, err := obj.PutObject(t.Context(), bucket, name, mustGetPutObjReader(t, strings.NewReader("data"), 4, "", ""), ObjectOptions{Versioned: true})
+		if err != nil {
+			t.Fatal(err)
+		}
+		requests := make(chan http.Header, 4)
+		var attempts atomic.Int32
+		peer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set(xhttp.AmzVersionID, oi.VersionID)
+			w.Header().Set(xhttp.ETag, "\""+oi.ETag+"\"")
+			w.Header().Set(xhttp.LastModified, oi.ModTime.Format(http.TimeFormat))
+			w.Header().Set(xhttp.ContentType, oi.ContentType)
+			if r.Method == http.MethodHead {
+				w.Header().Set(xhttp.ContentLength, "4")
+				w.WriteHeader(http.StatusOK)
+				return
+			}
+			requests <- r.Header.Clone()
+			w.Header().Set(xhttp.ContentType, "application/xml")
+			if attempts.Add(1) == 1 {
+				w.WriteHeader(http.StatusServiceUnavailable)
+				w.Write([]byte(`<Error><Code>SlowDown</Code><Message>retry fixture</Message></Error>`))
+				return
+			}
+			w.Write([]byte("<CopyObjectResult><LastModified>" + oi.ModTime.Format(time.RFC3339Nano) + "</LastModified><ETag>\"" + oi.ETag + "\"</ETag></CopyObjectResult>"))
+		}))
+		defer peer.Close()
+		client, err := minio.New(strings.TrimPrefix(peer.URL, "http://"), &minio.Options{Region: "us-east-1", MaxRetries: 1})
+		if err != nil {
+			t.Fatal(err)
+		}
+		worker, cleanup := r5ReplicationFixture(t, obj, bucket, client)
+		defer cleanup()
+		body := `<Tagging><TagSet><Tag><Key>key</Key><Value>queued</Value></Tag></TagSet></Tagging>`
+		w := r5Request(t, router, cred, http.MethodPut, "/"+bucket+"/"+name+"?tagging&versionId="+oi.VersionID, body, nil)
+		if w.Code != http.StatusOK || len(worker) != 1 {
+			t.Fatalf("tagging PUT: %d %s queued=%d", w.Code, w.Body.String(), len(worker))
+		}
+		old := (<-worker).(ReplicateObjectInfo)
+		// Delete through the actual handler before processing the old task.
+		w = r5Request(t, router, cred, http.MethodDelete, "/"+bucket+"/"+name+"?tagging&versionId="+oi.VersionID, "", nil)
+		if w.Code != http.StatusNoContent || len(worker) != 1 {
+			t.Fatalf("tagging DELETE: %d %s queued=%d", w.Code, w.Body.String(), len(worker))
+		}
+		deleted, err := obj.GetObjectInfo(t.Context(), bucket, name, ObjectOptions{VersionID: oi.VersionID})
+		if err != nil {
+			t.Fatal(err)
+		}
+		stamp := deleted.UserDefined[r5TagStamp]
+		for attempt := 0; attempt < 2; attempt++ {
+			result := replicateObject(t.Context(), old, obj)
+			want := replication.Failed
+			if attempt == 1 {
+				want = replication.Completed
+			}
+			if result.ReplicationStatus() != want {
+				t.Fatalf("attempt %d result=%+v want %s", attempt, result, want)
+			}
+			if len(result.Targets) != 1 || result.Targets[0].ReplicationAction != replicateMetadata || (result.Targets[0].Err != nil) != (attempt == 0) {
+				t.Fatalf("attempt %d reported wrong action/error: %+v", attempt, result)
+			}
+			r5Stored(t, obj, bucket, name, oi.VersionID, "", stamp)
+			select {
+			case h := <-requests:
+				if h.Get(xhttp.MinIOSourceTaggingTimestamp) != stamp || h.Get(xhttp.AmzObjectTagging) != "" || h.Get(xhttp.AmzTagDirective) != "REPLACE" || h.Get(xhttp.AmzMetadataDirective) != "" {
+					t.Fatalf("sender did not carry current deletion: %v", h)
+				}
+				t.Logf("%s attempt %d sent tags=%q timestamp=%s status=%s", instance, attempt, h.Get(xhttp.AmzObjectTagging), stamp, want)
+			default:
+				t.Fatal("no metadata COPY sent for same-empty target")
+			}
+		}
+		// With a real outgoing rule enabled, a signed incoming replica COPY
+		// must not queue another outgoing event and create a feedback loop.
+		before := len(worker)
+		r5Receive(t, obj, router, cred, bucket, "copy", deleted, stamp, nil)
+		if len(worker) != before {
+			t.Fatal("incoming replica COPY scheduled another outgoing event")
+		}
+		// The metadata sender must fail malformed stored revisions before COPY,
+		// just as the full retransmission option builder does.
+		_, err = obj.PutObjectTags(t.Context(), bucket, name, "", ObjectOptions{VersionID: oi.VersionID, UserDefined: map[string]string{r5TagStamp: "invalid"}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		target := globalBucketTargetSys.GetRemoteTargetClient(bucket, globalBucketTargetSys.targetsMap[bucket][0].Arn)
+		invalid := old.replicateAll(t.Context(), obj, target)
+		if invalid.ReplicationStatus != replication.Failed || invalid.Err == nil || len(requests) != 0 {
+			t.Fatalf("invalid timestamp was not rejected before send: %+v", invalid)
+		}
+	}})
+}
@@ -901,6 +901,8 @@ func serverMain(ctx *cli.Context) {
 		close(globalGridStart)
 		close(globalLockGridStart)

+		// The HTTP/1 listener preserves absolute header deadlines and renews the
+		// body read/write idle limits, so transfers may outlast IdleTimeout.
 		httpServer := xhttp.NewServer(getServerListenAddrs()).
 			UseHandler(setCriticalErrorHandler(corsHandler(handler))).
 			UseTLSConfig(newTLSConfig(getCert)).
@@ -0,0 +1,97 @@
+// Copyright (c) 2026 Feng Ruohang
+//
+// This file is part of Silo Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package cmd
+
+import (
+	"os"
+	"testing"
+	"time"
+
+	"github.com/minio/cli"
+	xhttp "github.com/minio/minio/internal/http"
+)
+
+func TestServerReadHeaderTimeoutConfig(t *testing.T) {
+	for _, tc := range []struct {
+		name, env, idle string
+		args            []string
+		want            time.Duration
+		fmtgen          bool
+	}{
+		{name: "default", want: xhttp.DefaultReadHeaderTimeout},
+		{name: "flag", args: []string{"--read-header-timeout=100ms"}, want: 100 * time.Millisecond},
+		{name: "environment", env: "170ms", want: 170 * time.Millisecond},
+		{name: "flag-over-environment", env: "170ms", args: []string{"--read-header-timeout=80ms"}, want: 80 * time.Millisecond},
+		{name: "yaml-retains-flag", args: []string{"--config=testdata/config/1.yaml", "--read-header-timeout=100ms"}, want: 100 * time.Millisecond},
+		{name: "zero-fallback", args: []string{"--read-header-timeout=0s"}},
+		{name: "zero-idle-default-header", idle: "0s", want: xhttp.DefaultReadHeaderTimeout},
+		{name: "negative-idle-default-header", idle: "-1s", want: xhttp.DefaultReadHeaderTimeout},
+		{name: "fmt-gen-unregistered-duration", env: "100ms", fmtgen: true},
+		{name: "negative-disabled", args: []string{"--read-header-timeout=-1s"}, want: -time.Second},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			for _, key := range []string{"MINIO_ARGS", "MINIO_VOLUMES", "MINIO_ENDPOINTS", "MINIO_CONFIG", "MINIO_ERASURE_SET_DRIVE_COUNT"} {
+				t.Setenv(key, "")
+			}
+			t.Setenv("MINIO_READ_HEADER_TIMEOUT", tc.env)
+			if tc.env == "" {
+				if err := os.Unsetenv("MINIO_READ_HEADER_TIMEOUT"); err != nil {
+					t.Fatal(err)
+				}
+			}
+			idle := tc.idle
+			if idle == "" {
+				idle = "2s"
+			}
+			t.Setenv("MINIO_IDLE_TIMEOUT", idle)
+			idleWant, err := time.ParseDuration(idle)
+			if err != nil {
+				t.Fatal(err)
+			}
+			commandName, flags := "server", serverCmd.Flags
+			if tc.fmtgen {
+				commandName, flags = "fmt-gen", fmtGenFlags
+				idleWant = 0
+			}
+			var got serverCtxt
+			called := false
+			app := cli.NewApp()
+			app.Commands = []cli.Command{{Name: commandName, Flags: flags, Action: func(ctx *cli.Context) error {
+				called = true
+				if parsed := ctx.Duration("read-header-timeout"); parsed != tc.want {
+					t.Errorf("CLI read-header-timeout=%s, expected=%s", parsed, tc.want)
+				}
+				return buildServerCtxt(ctx, &got)
+			}}}
+			args := append([]string{"silo", commandName}, tc.args...)
+			args = append(args, t.TempDir())
+			if err := app.Run(args); err != nil {
+				t.Fatal(err)
+			}
+			if !called {
+				t.Fatal("server action did not run")
+			}
+			if got.ReadHeaderTimeout != tc.want {
+				t.Errorf("parsed ReadHeaderTimeout = %s, want %s", got.ReadHeaderTimeout, tc.want)
+			}
+			if got.IdleTimeout != idleWant {
+				t.Errorf("parsed IdleTimeout = %s, want %s", got.IdleTimeout, idleWant)
+			}
+		})
+	}
+}
@@ -109,6 +109,15 @@ func testStorageAPIListDir(t *testing.T, storage StorageAPI) {
 			}
 		}
 	}
+	for _, name := range []string{"one", "two", "three"} {
+		if err := storage.AppendFile(t.Context(), "foo", "bounded/"+name, []byte("x")); err != nil {
+			t.Fatal(err)
+		}
+	}
+	entries, err := storage.ListDir(t.Context(), "", "foo", "bounded", 2)
+	if err != nil || len(entries) != 2 {
+		t.Fatalf("ListDir count was lost in storage/RPC path: %v %v", entries, err)
+	}
 }

 func testStorageAPIReadAll(t *testing.T, storage StorageAPI) {
@@ -35,7 +35,7 @@ set -e
 export MINIO_CI_CD=1
 export MINIO_BROWSER=off
 export MINIO_ROOT_USER="minio"
-export MINIO_ROOT_PASSWORD="silo123"
+export MINIO_ROOT_PASSWORD="silo12345"
 export MINIO_KMS_AUTO_ENCRYPTION=off
 export MINIO_PROMETHEUS_AUTH_TYPE=public
 export MINIO_KMS_SECRET_KEY=my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw=
@@ -58,8 +58,8 @@ silo server --address 127.0.0.1:9003 "http://127.0.0.1:9003/tmp/multisiteb/data/
 silo server --address 127.0.0.1:9004 "http://127.0.0.1:9003/tmp/multisiteb/data/disterasure/xl{1...4}" \
 	"http://127.0.0.1:9004/tmp/multisiteb/data/disterasure/xl{5...8}" >/tmp/siteb_2.log 2>&1 &

-export MC_HOST_sitea=http://minio:silo123@127.0.0.1:9001
-export MC_HOST_siteb=http://minio:silo123@127.0.0.1:9004
+export MC_HOST_sitea=http://minio:silo12345@127.0.0.1:9001
+export MC_HOST_siteb=http://minio:silo12345@127.0.0.1:9004

 ./mc ready sitea
 ./mc ready siteb
@@ -83,7 +83,7 @@ done

 echo "adding replication rule for site a -> site b"
 ./mc replicate add sitea/bucket/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9004/bucket
+	--remote-bucket http://minio:silo12345@127.0.0.1:9004/bucket

 remote_arn=$(./mc replicate ls sitea/bucket --json | jq -r .rule.Destination.Bucket)
 sleep 1
@@ -137,7 +137,7 @@ fi

 echo "adding replication rule for site a -> site b"
 ./mc replicate add sitea/bucket-version/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9004/bucket-version
+	--remote-bucket http://minio:silo12345@127.0.0.1:9004/bucket-version

 ./mc mb sitea/bucket-version/directory/

@@ -37,7 +37,7 @@ set -e
 export MINIO_CI_CD=1
 export MINIO_BROWSER=off
 export MINIO_ROOT_USER="minio"
-export MINIO_ROOT_PASSWORD="silo123"
+export MINIO_ROOT_PASSWORD="silo12345"
 export MINIO_KMS_AUTO_ENCRYPTION=off
 export MINIO_PROMETHEUS_AUTH_TYPE=public
 export MINIO_KMS_SECRET_KEY=my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw=
@@ -70,9 +70,9 @@ silo server --address 127.0.0.1:9005 "http://127.0.0.1:9005/tmp/multisitec/data/
 silo server --address 127.0.0.1:9006 "http://127.0.0.1:9005/tmp/multisitec/data/disterasure/xl{1...4}" \
 	"http://127.0.0.1:9006/tmp/multisitec/data/disterasure/xl{5...8}" >/tmp/sitec_2.log 2>&1 &

-export MC_HOST_sitea=http://minio:silo123@127.0.0.1:9001
-export MC_HOST_siteb=http://minio:silo123@127.0.0.1:9004
-export MC_HOST_sitec=http://minio:silo123@127.0.0.1:9006
+export MC_HOST_sitea=http://minio:silo12345@127.0.0.1:9001
+export MC_HOST_siteb=http://minio:silo12345@127.0.0.1:9004
+export MC_HOST_sitec=http://minio:silo12345@127.0.0.1:9006

 ./mc ready sitea
 ./mc ready siteb
@@ -93,73 +93,73 @@ export MC_HOST_sitec=http://minio:silo123@127.0.0.1:9006
 echo "adding replication rule for a -> b : ${remote_arn}"
 sleep 1
 ./mc replicate add sitea/bucket/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9004/bucket \
+	--remote-bucket http://minio:silo12345@127.0.0.1:9004/bucket \
 	--replicate "existing-objects,delete,delete-marker,replica-metadata-sync"
 sleep 1

 echo "adding replication rule for b -> a : ${remote_arn}"
 ./mc replicate add siteb/bucket/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9001/bucket \
+	--remote-bucket http://minio:silo12345@127.0.0.1:9001/bucket \
 	--replicate "existing-objects,delete,delete-marker,replica-metadata-sync"
 sleep 1

 echo "adding replication rule for a -> c : ${remote_arn}"
 ./mc replicate add sitea/bucket/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9006/bucket \
+	--remote-bucket http://minio:silo12345@127.0.0.1:9006/bucket \
 	--replicate "existing-objects,delete,delete-marker,replica-metadata-sync" --priority 2
 sleep 1

 echo "adding replication rule for c -> a : ${remote_arn}"
 ./mc replicate add sitec/bucket/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9001/bucket \
+	--remote-bucket http://minio:silo12345@127.0.0.1:9001/bucket \
 	--replicate "existing-objects,delete,delete-marker,replica-metadata-sync" --priority 2
 sleep 1

 echo "adding replication rule for b -> c : ${remote_arn}"
 ./mc replicate add siteb/bucket/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9006/bucket \
+	--remote-bucket http://minio:silo12345@127.0.0.1:9006/bucket \
 	--replicate "existing-objects,delete,delete-marker,replica-metadata-sync" --priority 3
 sleep 1

 echo "adding replication rule for c -> b : ${remote_arn}"
 ./mc replicate add sitec/bucket/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9004/bucket \
+	--remote-bucket http://minio:silo12345@127.0.0.1:9004/bucket \
 	--replicate "existing-objects,delete,delete-marker,replica-metadata-sync" --priority 3
 sleep 1

 echo "adding replication rule for olockbucket a -> b : ${remote_arn}"
 ./mc replicate add sitea/olockbucket/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9004/olockbucket \
+	--remote-bucket http://minio:silo12345@127.0.0.1:9004/olockbucket \
 	--replicate "existing-objects,delete,delete-marker,replica-metadata-sync"
 sleep 1

 echo "adding replication rule for olockbucket b -> a : ${remote_arn}"
 ./mc replicate add siteb/olockbucket/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9001/olockbucket \
+	--remote-bucket http://minio:silo12345@127.0.0.1:9001/olockbucket \
 	--replicate "existing-objects,delete,delete-marker,replica-metadata-sync"
 sleep 1

 echo "adding replication rule for olockbucket a -> c : ${remote_arn}"
 ./mc replicate add sitea/olockbucket/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9006/olockbucket \
+	--remote-bucket http://minio:silo12345@127.0.0.1:9006/olockbucket \
 	--replicate "existing-objects,delete,delete-marker,replica-metadata-sync" --priority 2
 sleep 1

 echo "adding replication rule for olockbucket c -> a : ${remote_arn}"
 ./mc replicate add sitec/olockbucket/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9001/olockbucket \
+	--remote-bucket http://minio:silo12345@127.0.0.1:9001/olockbucket \
 	--replicate "existing-objects,delete,delete-marker,replica-metadata-sync" --priority 2
 sleep 1

 echo "adding replication rule for olockbucket b -> c : ${remote_arn}"
 ./mc replicate add siteb/olockbucket/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9006/olockbucket \
+	--remote-bucket http://minio:silo12345@127.0.0.1:9006/olockbucket \
 	--replicate "existing-objects,delete,delete-marker,replica-metadata-sync" --priority 3
 sleep 1

 echo "adding replication rule for olockbucket c -> b : ${remote_arn}"
 ./mc replicate add sitec/olockbucket/ \
-	--remote-bucket http://minio:silo123@127.0.0.1:9004/olockbucket \
+	--remote-bucket http://minio:silo12345@127.0.0.1:9004/olockbucket \
 	--replicate "existing-objects,delete,delete-marker,replica-metadata-sync" --priority 3
 sleep 1

@@ -204,33 +204,33 @@ head -c 221227088 </dev/urandom >200M
 sleep 10

 echo "Verifying ETag for all objects"
-./s3-check-md5 -versions -access-key minio -secret-key silo123 -endpoint http://127.0.0.1:9001/ -bucket bucket
-./s3-check-md5 -versions -access-key minio -secret-key silo123 -endpoint http://127.0.0.1:9002/ -bucket bucket
-./s3-check-md5 -versions -access-key minio -secret-key silo123 -endpoint http://127.0.0.1:9003/ -bucket bucket
-./s3-check-md5 -versions -access-key minio -secret-key silo123 -endpoint http://127.0.0.1:9004/ -bucket bucket
-./s3-check-md5 -versions -access-key minio -secret-key silo123 -endpoint http://127.0.0.1:9005/ -bucket bucket
-./s3-check-md5 -versions -access-key minio -secret-key silo123 -endpoint http://127.0.0.1:9006/ -bucket bucket
+./s3-check-md5 -versions -access-key minio -secret-key silo12345 -endpoint http://127.0.0.1:9001/ -bucket bucket
+./s3-check-md5 -versions -access-key minio -secret-key silo12345 -endpoint http://127.0.0.1:9002/ -bucket bucket
+./s3-check-md5 -versions -access-key minio -secret-key silo12345 -endpoint http://127.0.0.1:9003/ -bucket bucket
+./s3-check-md5 -versions -access-key minio -secret-key silo12345 -endpoint http://127.0.0.1:9004/ -bucket bucket
+./s3-check-md5 -versions -access-key minio -secret-key silo12345 -endpoint http://127.0.0.1:9005/ -bucket bucket
+./s3-check-md5 -versions -access-key minio -secret-key silo12345 -endpoint http://127.0.0.1:9006/ -bucket bucket

-./s3-check-md5 -versions -access-key minio -secret-key silo123 -endpoint http://127.0.0.1:9001/ -bucket olockbucket
-./s3-check-md5 -versions -access-key minio -secret-key silo123 -endpoint http://127.0.0.1:9002/ -bucket olockbucket
-./s3-check-md5 -versions -access-key minio -secret-key silo123 -endpoint http://127.0.0.1:9003/ -bucket olockbucket
-./s3-check-md5 -versions -access-key minio -secret-key silo123 -endpoint http://127.0.0.1:9004/ -bucket olockbucket
-./s3-check-md5 -versions -access-key minio -secret-key silo123 -endpoint http://127.0.0.1:9005/ -bucket olockbucket
-./s3-check-md5 -versions -access-key minio -secret-key silo123 -endpoint http://127.0.0.1:9006/ -bucket olockbucket
+./s3-check-md5 -versions -access-key minio -secret-key silo12345 -endpoint http://127.0.0.1:9001/ -bucket olockbucket
+./s3-check-md5 -versions -access-key minio -secret-key silo12345 -endpoint http://127.0.0.1:9002/ -bucket olockbucket
+./s3-check-md5 -versions -access-key minio -secret-key silo12345 -endpoint http://127.0.0.1:9003/ -bucket olockbucket
+./s3-check-md5 -versions -access-key minio -secret-key silo12345 -endpoint http://127.0.0.1:9004/ -bucket olockbucket
+./s3-check-md5 -versions -access-key minio -secret-key silo12345 -endpoint http://127.0.0.1:9005/ -bucket olockbucket
+./s3-check-md5 -versions -access-key minio -secret-key silo12345 -endpoint http://127.0.0.1:9006/ -bucket olockbucket

 # additional tests for encryption object alignment
 go install -v github.com/minio/multipart-debug@latest

-upload_id=$(multipart-debug --endpoint 127.0.0.1:9001 --accesskey minio --secretkey silo123 multipart new --bucket bucket --object new-test-encrypted-object --encrypt)
+upload_id=$(multipart-debug --endpoint 127.0.0.1:9001 --accesskey minio --secretkey silo12345 multipart new --bucket bucket --object new-test-encrypted-object --encrypt)

 dd if=/dev/urandom bs=1 count=7048531 of=/tmp/7048531.txt
 dd if=/dev/urandom bs=1 count=2847391 of=/tmp/2847391.txt

 sudo apt install jq -y

-etag_1=$(multipart-debug --endpoint 127.0.0.1:9002 --accesskey minio --secretkey silo123 multipart upload --bucket bucket --object new-test-encrypted-object --uploadid ${upload_id} --file /tmp/7048531.txt --number 1 | jq -r .ETag)
-etag_2=$(multipart-debug --endpoint 127.0.0.1:9001 --accesskey minio --secretkey silo123 multipart upload --bucket bucket --object new-test-encrypted-object --uploadid ${upload_id} --file /tmp/2847391.txt --number 2 | jq -r .ETag)
-multipart-debug --endpoint 127.0.0.1:9002 --accesskey minio --secretkey silo123 multipart complete --bucket bucket --object new-test-encrypted-object --uploadid ${upload_id} 1.${etag_1} 2.${etag_2}
+etag_1=$(multipart-debug --endpoint 127.0.0.1:9002 --accesskey minio --secretkey silo12345 multipart upload --bucket bucket --object new-test-encrypted-object --uploadid ${upload_id} --file /tmp/7048531.txt --number 1 | jq -r .ETag)
+etag_2=$(multipart-debug --endpoint 127.0.0.1:9001 --accesskey minio --secretkey silo12345 multipart upload --bucket bucket --object new-test-encrypted-object --uploadid ${upload_id} --file /tmp/2847391.txt --number 2 | jq -r .ETag)
+multipart-debug --endpoint 127.0.0.1:9002 --accesskey minio --secretkey silo12345 multipart complete --bucket bucket --object new-test-encrypted-object --uploadid ${upload_id} 1.${etag_1} 2.${etag_2}

 sleep 10

@@ -35,7 +35,7 @@ set -e
 export MINIO_CI_CD=1
 export MINIO_BROWSER=off
 export MINIO_ROOT_USER="minio"
-export MINIO_ROOT_PASSWORD="silo123"
+export MINIO_ROOT_PASSWORD="silo12345"
 export MINIO_KMS_AUTO_ENCRYPTION=off
 export MINIO_PROMETHEUS_AUTH_TYPE=public
 export MINIO_KMS_SECRET_KEY=my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw=
@@ -70,10 +70,10 @@ silo server --address 127.0.0.1:9008 "http://127.0.0.1:9007/tmp/multisited/data/

 # Wait to make sure all Silo instances are up

-export MC_HOST_sitea=http://minio:silo123@127.0.0.1:9001
-export MC_HOST_siteb=http://minio:silo123@127.0.0.1:9004
-export MC_HOST_sitec=http://minio:silo123@127.0.0.1:9006
-export MC_HOST_sited=http://minio:silo123@127.0.0.1:9008
+export MC_HOST_sitea=http://minio:silo12345@127.0.0.1:9001
+export MC_HOST_siteb=http://minio:silo12345@127.0.0.1:9004
+export MC_HOST_sitec=http://minio:silo12345@127.0.0.1:9006
+export MC_HOST_sited=http://minio:silo12345@127.0.0.1:9008

 ./mc ready sitea
 ./mc ready siteb
@@ -89,7 +89,7 @@ export MC_HOST_sited=http://minio:silo123@127.0.0.1:9008
 sleep 10s

 ## Add warm tier
-./mc ilm tier add minio sitea WARM-TIER --endpoint http://localhost:9006 --access-key minio --secret-key silo123 --bucket bucket
+./mc ilm tier add minio sitea WARM-TIER --endpoint http://localhost:9006 --access-key minio --secret-key silo12345 --bucket bucket

 ## Add ILM rules
 ./mc ilm add sitea/bucket --transition-days 0 --transition-tier WARM-TIER --transition-days 0 --noncurrent-expire-days 2 --expire-days 3 --prefix "myprefix" --tags "tag1=val1&tag2=val2"
@@ -38,7 +38,7 @@ pid=$!

 mc ready mysilo

-mc admin user add mysilo/ silo123 silo123
+mc admin user add mysilo/ silo123 silo12345

 mc admin policy create mysilo/ deny-non-sse-kms-pol ./docs/iam/policies/deny-non-sse-kms-objects.json
 mc admin policy create mysilo/ deny-invalid-sse-kms-pol ./docs/iam/policies/deny-objects-with-invalid-sse-kms-key-id.json
@@ -50,7 +50,7 @@ mc admin policy attach mysilo consoleAdmin --user silo123
 mc mb -l mysilo/test-bucket
 mc mb -l mysilo/multi-key-poc

-export MC_HOST_mysilo1="http://silo123:silo123@localhost:9000/"
+export MC_HOST_mysilo1="http://silo123:silo12345@localhost:9000/"

 mc cp /etc/issue mysilo1/test-bucket
 ret=$?
@@ -0,0 +1,95 @@
+# R4–R8 集成核验
+
+## 结论与范围
+
+2026-09-16，R5、R6、R8 的修复在已包含 R4、R7 的 main 基线上完成集成。
+本地完整 `cmd`、`internal` 测试、相关 race 检查、仓库 verifiers、构建和
+HTTP 超时进程探针均通过。环境中的真实 `claude-opus-5`（effort `max`）独立
+阅读合并差异与调用链，结论为 **GO_WITH_NONBLOCKING_NOTES，零阻断项**。
+
+本记录对应 main 合并前的代码核验。最终 PR 的 Linux CI、DCO 和合并结果以该
+PR 的实际提交及检查为准；这里的本地结果不代表发布、部署或多站点生产验收。
+
+## 提交对应关系
+
+基线：`9f3037e941a49ab4cd8a0eed7c0f01083fbe4bbe`。
+
+| 问题 | 原修复提交 | 集成提交 | 行为 |
+| --- | --- | --- | --- |
+| R4 | PR [#193](https://github.com/pgsty/silo/pull/193)，已在基线 | `af2b1794d38d9e70e1d2c3ee692426e4b6cab4bd`（merge） | SSE-KMS 复制保留标签修订时间 |
+| R7 | PR [#194](https://github.com/pgsty/silo/pull/194)，已在基线 | `9f3037e941a49ab4cd8a0eed7c0f01083fbe4bbe`（merge） | 复制元数据恢复不再重新写入传输用 aws-chunked |
+| R5 | `115fe8b12329d147adbaf817faa1737392ecbf9b` | `680eac66e40b0980bc20e70d7ad34185096e63f5` | 删除标签推进修订，接收端抵御乱序事件，重试及 ACK 保留新状态 |
+| R6 | `cf381a7151ef25fc95ace5fedcd767fa19410de2` | `0c61128d23f05ce6b37e7ace713c3ffbfb68f4cb` | 旧形态 marker purge 正确分类，MRF 恢复 marker 并保留重试次数 |
+| R6 核验记录 | `d38edb2c46182d3a8fa96e040604493d20a4b478` | `aea3882c95d16ec5598a07b40d593e04054137a9` | 保存 v3 共识及验证边界 |
+| R8 | `0d48d32d7e038ae1ea5966f3d7e0cb86780a6311` | `055030ea53ca92ee22ce1e601ef4757c247edde8` | 配置绑定到读头绝对超时，正文继续采用滚动空闲超时 |
+
+各原任务先取得 Opus 方案共识，再实施修复。原始方案、实现复核及验证记录保留在
+[R5](../r5/verification.md)、[R6](../r6/README.md)、[R8](../r8/README.md)。
+R5、R6、R8 原任务又分别只读核验了集成后的交叉影响，未发现新增生产阻断项。
+
+集成使用 `git cherry-pick -x -s`，保留原作者、来源及 DCO。后续
+`80684fed59f556d579e268c5a855d936c1347b68` 仅处理两类贡献规范问题：
+
+- 六个新建测试文件统一使用实际贡献者姓名及 AGPL-3.0-or-later 头部；从
+  `package` 开始的内容逐字节不变，Linux build tag 保留。
+- 按 CONTRIBUTING 的规则更新兼容标识清单。唯一新增条目是 R6 测试拼接既有
+  replication ARN 所用的 `arn:minio:replication::`，没有新增协议名称或生产行为。
+
+22 个源码／测试文件的最终哈希见 [manifest.json](manifest.json)。共享文件中的
+R5、R6 补丁与原修复具有相同稳定 patch ID；其余源文件直接比较，六个测试仅允许
+上述头部差异。[等价检查](evidence/integration-equivalence.json)全部通过。
+
+## Opus 集成复核与处置
+
+实际 CLI 为 2.1.270，显式指定 `claude-opus-5 --effort max`；只允许 Read、Grep、
+Glob，未执行测试或修改代码。实际返回模型为 `claude-opus-5`，进程和结果均成功。
+复核基于 `055030ea53ca92ee22ce1e601ef4757c247edde8` 的 22 个文件及完整差异；
+此后的代码变化仅为上文已证明等价的头部与兼容清单调整。
+
+原文、调用元数据及提示词分别见 [复核结果](evidence/opus-review.md)、
+[metadata](evidence/opus-integration.metadata.json)、[prompt](evidence/opus-integration.prompt.md)。
+保留原文中的判断，再用直接证据逐项处置，避免把模型意见当作测试结果：
+
+| 非阻断意见 | 核验与决定 |
+| --- | --- |
+| 非法或空的历史标签时间戳可能使复制失败并重试 | 保留 R5 共识中的失败关闭行为；历史异常数据修复另行处理 |
+| 带标签修订的版本在 resync 时可能多一次 metadata COPY | R5 已接受的可靠性成本；正常 COMPLETED 路径保持原有门控 |
+| purge 审计状态由 COMPLETE 规范为 COMPLETED，统计开始记录实际目标结果 | R6 的预期行为；后续发布说明应告知审计／指标使用者 |
+| 配置的较短 ReadHeaderTimeout 同时缩短 TLS 握手窗口 | Go net/http 的预期语义，已在 R8 共识中说明 |
+| 新增多池标签测试单独运行可能缺少全局初始化 | **未成立**：精确单独运行通过；`consistencyPools` 经 `prepareErasurePoolsWithContext` → `initObjectLayer` → `newTestObjectLayer` 调用 `initAllSubsystems`。保留测试原样 |
+| 审计 fixture 重复取消可能输出栈信息 | 本地完整及 race 测试通过；不扩大本次生产修复范围 |
+| 新测试文件头部应按实际贡献者整理 | 已在 `80684fed` 修正，测试代码及 build tag 不变 |
+
+## 本地直接验证
+
+下表全部针对 `80684fed59f556d579e268c5a855d936c1347b68`，未使用额外的源码或
+容量 overlay；测试代码自身的容量 fixture 保留。限制并行度仅为
+`GOMAXPROCS=4`、`GOFLAGS=-p=2`，并使用
+仓库 CI 的 `MINIO_API_REQUESTS_MAX=10000`。详细命令、时间和日志哈希在
+[validation-results.json](evidence/validation-results.json)。
+
+| 检查 | 结果 |
+| --- | --- |
+| `make verifiers`：lint、生成文件、rebrand guard | 通过，76.9 秒；可选 typos 工具按现有 Makefile 规则跳过 |
+| `make build`、`./silo --version` | 通过，产物为 silo |
+| `CGO_ENABLED=0 go test -p 2 ./cmd ./internal/... -count=1 -timeout=30m` | 全部通过，340.2 秒，50 个有测试的包 |
+| `CGO_ENABLED=1 go test -race`，cmd/deadlineconn/http 中变更测试的函数集合 | 通过，46.3 秒；Linux build tag 用例由最终 Linux CI 覆盖 |
+| `TestAPIPoolsTaggingReplicaDeletion` 精确单独执行 | 通过，无需其他测试预先运行 |
+| 实际 silo 进程的 CLI／环境变量读头超时探针 | 两种配置均在 100ms 读头限制下拒绝 400ms 才完成的请求头；空闲超时为 2s，随后健康请求成功 |
+
+进程探针使用二进制 SHA-256
+`1cc536f1a3c8d8372ff2d5b140b1fd2bc98a299324fea0f73f67288d48104ce4`。
+原始输出见 [runtime-probe.json](evidence/runtime-probe.json)。
+
+各子任务较早遇到的磁盘容量不足或筛选测试初始化问题，不作为这次通过的证据。
+本地完整测试已重新执行并成功；原失败记录仍保留在各自调查档案。
+
+## 验收边界
+
+- 最终 PR 必须通过实际提交的全部仓库检查，尤其 Linux internal 测试、完整 cmd
+  测试、构建／vet、lint／生成文件、交叉编译、S3 Select race、DCO 和漏洞检查。
+- 既有无时间戳对象、异常时间戳、标签筛选的目标选择、任意站点时钟偏差等不由本次
+  修复追溯重建。共享状态解析器的历史限制按 R6 v3 共识在写入点规避。
+- R8 原先未完成的 S3 长传输脚本不计为通过；本次进程探针验证配置生效，不替代
+  S3 长传输、独立多进程、多节点或跨区域生产验收。
+- 本次不引入依赖变更或上游 MinIO 兼容硬门槛；R9 不属于这五项修复。
@@ -0,0 +1,79 @@
+ok  	github.com/minio/minio/cmd	320.458s
+ok  	github.com/minio/minio/internal/amztime	1.605s
+ok  	github.com/minio/minio/internal/arn	0.392s
+ok  	github.com/minio/minio/internal/auth	0.440s
+ok  	github.com/minio/minio/internal/bpool	0.422s
+ok  	github.com/minio/minio/internal/bucket/bandwidth	0.450s
+ok  	github.com/minio/minio/internal/bucket/cors	0.484s
+ok  	github.com/minio/minio/internal/bucket/encryption	0.644s
+ok  	github.com/minio/minio/internal/bucket/lifecycle	0.647s
+ok  	github.com/minio/minio/internal/bucket/object/lock	0.653s
+ok  	github.com/minio/minio/internal/bucket/replication	0.496s
+ok  	github.com/minio/minio/internal/bucket/versioning	0.449s
+ok  	github.com/minio/minio/internal/cachevalue	5.457s
+?   	github.com/minio/minio/internal/color	[no test files]
+ok  	github.com/minio/minio/internal/config	0.656s
+?   	github.com/minio/minio/internal/config/api	[no test files]
+?   	github.com/minio/minio/internal/config/batch	[no test files]
+?   	github.com/minio/minio/internal/config/browser	[no test files]
+?   	github.com/minio/minio/internal/config/callhome	[no test files]
+ok  	github.com/minio/minio/internal/config/compress	0.624s
+ok  	github.com/minio/minio/internal/config/dns	0.731s
+?   	github.com/minio/minio/internal/config/drive	[no test files]
+ok  	github.com/minio/minio/internal/config/etcd	1.015s
+?   	github.com/minio/minio/internal/config/heal	[no test files]
+ok  	github.com/minio/minio/internal/config/identity/ldap	0.593s
+ok  	github.com/minio/minio/internal/config/identity/openid	0.675s
+?   	github.com/minio/minio/internal/config/identity/openid/provider	[no test files]
+?   	github.com/minio/minio/internal/config/identity/plugin	[no test files]
+?   	github.com/minio/minio/internal/config/identity/tls	[no test files]
+ok  	github.com/minio/minio/internal/config/ilm	1.057s
+?   	github.com/minio/minio/internal/config/lambda	[no test files]
+ok  	github.com/minio/minio/internal/config/lambda/event	0.485s
+?   	github.com/minio/minio/internal/config/lambda/target	[no test files]
+ok  	github.com/minio/minio/internal/config/notify	0.752s
+?   	github.com/minio/minio/internal/config/policy/opa	[no test files]
+?   	github.com/minio/minio/internal/config/policy/plugin	[no test files]
+?   	github.com/minio/minio/internal/config/scanner	[no test files]
+ok  	github.com/minio/minio/internal/config/storageclass	0.585s
+ok  	github.com/minio/minio/internal/config/subnet	0.582s
+ok  	github.com/minio/minio/internal/crypto	0.843s
+ok  	github.com/minio/minio/internal/deadlineconn	4.934s
+ok  	github.com/minio/minio/internal/disk	0.418s
+ok  	github.com/minio/minio/internal/dsync	131.144s
+ok  	github.com/minio/minio/internal/etag	0.504s
+ok  	github.com/minio/minio/internal/event	0.595s
+ok  	github.com/minio/minio/internal/event/target	0.957s
+ok  	github.com/minio/minio/internal/grid	7.616s
+ok  	github.com/minio/minio/internal/handlers	0.717s
+ok  	github.com/minio/minio/internal/hash	0.700s
+?   	github.com/minio/minio/internal/hash/sha256	[no test files]
+ok  	github.com/minio/minio/internal/http	13.643s
+?   	github.com/minio/minio/internal/init	[no test files]
+ok  	github.com/minio/minio/internal/ioutil	1.921s
+ok  	github.com/minio/minio/internal/jwt	0.423s
+ok  	github.com/minio/minio/internal/kms	0.538s
+ok  	github.com/minio/minio/internal/lock	1.077s
+ok  	github.com/minio/minio/internal/logger	0.546s
+?   	github.com/minio/minio/internal/logger/message/audit	[no test files]
+?   	github.com/minio/minio/internal/logger/target/console	[no test files]
+?   	github.com/minio/minio/internal/logger/target/http	[no test files]
+?   	github.com/minio/minio/internal/logger/target/kafka	[no test files]
+?   	github.com/minio/minio/internal/logger/target/loggertypes	[no test files]
+?   	github.com/minio/minio/internal/logger/target/testlogger	[no test files]
+ok  	github.com/minio/minio/internal/lsync	10.501s
+?   	github.com/minio/minio/internal/mcontext	[no test files]
+?   	github.com/minio/minio/internal/mountinfo	[no test files]
+?   	github.com/minio/minio/internal/net	[no test files]
+?   	github.com/minio/minio/internal/once	[no test files]
+ok  	github.com/minio/minio/internal/pubsub	0.511s
+ok  	github.com/minio/minio/internal/rest	0.525s
+ok  	github.com/minio/minio/internal/ringbuffer	1.316s
+ok  	github.com/minio/minio/internal/s3select	0.603s
+ok  	github.com/minio/minio/internal/s3select/csv	0.446s
+ok  	github.com/minio/minio/internal/s3select/json	0.439s
+ok  	github.com/minio/minio/internal/s3select/jstream	0.417s
+?   	github.com/minio/minio/internal/s3select/parquet	[no test files]
+?   	github.com/minio/minio/internal/s3select/simdj	[no test files]
+ok  	github.com/minio/minio/internal/s3select/sql	0.425s
+ok  	github.com/minio/minio/internal/store	1.451s
@@ -0,0 +1,50 @@
+[
+  {
+    "file": "cmd/replication-delete-mrf_test.go",
+    "before_sha256": "5e160f7e19cbbb8cd5fa4e7ffd9cff9e09361b3fc4c5ee5ae61458f99c777781",
+    "after_sha256": "6fcfaf505d28f98e42dff9c0d965895be2c2d112e9e996220d424aea1f76d691",
+    "body_sha256": "5b3cecec74273540f4a5f82ca55e8a28545d0252822af3568f7e36b19011bda8",
+    "body_identical": true,
+    "build_prefix_preserved": true
+  },
+  {
+    "file": "cmd/replication-delete-operation_test.go",
+    "before_sha256": "2888a04a543324776041316de2821f388d28c3c1a6f5d0031e5ac9d34f58d504",
+    "after_sha256": "2e674cab5ca4dbc38cb2c1ddcca117269276e6419e1869c154c3bd6a05676715",
+    "body_sha256": "7921af42a9f123450e3e567d0bf65cd030678404709c77fde4a9cbb366230c35",
+    "body_identical": true,
+    "build_prefix_preserved": true
+  },
+  {
+    "file": "cmd/server_deadline_config_test.go",
+    "before_sha256": "1013157f83baa5f7882ec2d41c7b1fccb9e05fb418d0fa61263953037c9698c4",
+    "after_sha256": "a8259d273922a8973b44d9a468791761d373fe265fff8b2b53871e4626b11405",
+    "body_sha256": "5714a9275aee7230d54ba8ed03e3705a3cf6e150bda122929a9131b4b2b8dd5c",
+    "body_identical": true,
+    "build_prefix_preserved": true
+  },
+  {
+    "file": "internal/deadlineconn/deadlineconn_strict_test.go",
+    "before_sha256": "f405690c9ff044595f48323d68f4a9b33ce695b3ad6820f54f17151067bfae5e",
+    "after_sha256": "b4aec28c5daddb36e6ebb98dd8af2a44b7a2c48f0660068534f69669609f67a7",
+    "body_sha256": "ab2b54e29ed34de6e59ba2fa4984d61ed5f93d74ae4f6cd22dd44ba77a37e569",
+    "body_identical": true,
+    "build_prefix_preserved": true
+  },
+  {
+    "file": "internal/http/dial_deadline_linux_test.go",
+    "before_sha256": "0939d05b72a09760d53fcdf249775989e3f89bca824b9961d0b2a657ebfdf41e",
+    "after_sha256": "c4c83bda92ba9bac53166453920456134b3d8265cd59101b4203067c67eca59e",
+    "body_sha256": "fac091ef08f29fe32c2668eccd8cd505106c9fe3c4715e4c3ed9063d4b71c86e",
+    "body_identical": true,
+    "build_prefix_preserved": true
+  },
+  {
+    "file": "internal/http/server_deadline_test.go",
+    "before_sha256": "a6e687b3904a876fa92a4c5b86453159f3e5a38a4b9412dc213c7772f47fbf0b",
+    "after_sha256": "87303cc389bf1cf759898489f06b001073de2dd9c4b3687c4eca14aa186b62ab",
+    "body_sha256": "20b238f34090c356b2254388e863d77d0a316f33b849291d15d94fad260f23dd",
+    "body_identical": true,
+    "build_prefix_preserved": true
+  }
+]
@@ -0,0 +1,35 @@
+{
+  "head": "80684fed59f556d579e268c5a855d936c1347b68",
+  "checks": {
+    "r6_shared_file_patch": true,
+    "r5_shared_file_patch": true,
+    "cmd/erasure-object.go": true,
+    "cmd/erasure-server-pool-consistency.go": true,
+    "cmd/erasure-server-pool.go": true,
+    "cmd/object-handlers-common.go": true,
+    "cmd/object-handlers.go": true,
+    "cmd/object-multipart-handlers.go": true,
+    "cmd/replication-tagging-order_test.go": true,
+    "cmd/replication-tagging-sender_test.go": true,
+    "cmd/bucket-replication-utils.go": true,
+    "cmd/replication-delete-marker_test.go": true,
+    "cmd/replication-delete-operation_test.go": true,
+    "cmd/replication-delete-mrf_test.go": true,
+    "cmd/common-main.go": true,
+    "cmd/server-main.go": true,
+    "internal/deadlineconn/deadlineconn.go": true,
+    "internal/http/listener.go": true,
+    "internal/http/server.go": true,
+    "cmd/server_deadline_config_test.go": true,
+    "internal/deadlineconn/deadlineconn_strict_test.go": true,
+    "internal/http/dial_deadline_linux_test.go": true,
+    "internal/http/server_deadline_test.go": true,
+    "only_reviewed_hygiene_changes": true,
+    "dco:80684fed59f556d579e268c5a855d936c1347b68": true,
+    "dco:055030ea53ca92ee22ce1e601ef4757c247edde8": true,
+    "dco:aea3882c95d16ec5598a07b40d593e04054137a9": true,
+    "dco:0c61128d23f05ce6b37e7ace713c3ffbfb68f4cb": true,
+    "dco:680eac66e40b0980bc20e70d7ad34185096e63f5": true
+  },
+  "all_pass": true
+}
@@ -0,0 +1 @@
+ok  	github.com/minio/minio/cmd	1.583s
@@ -0,0 +1,17 @@
+{
+  "command": [
+    "go",
+    "test",
+    "-p",
+    "2",
+    "./cmd",
+    "-run",
+    "^TestAPIPoolsTaggingReplicaDeletion$",
+    "-count=1",
+    "-timeout=2m"
+  ],
+  "exit_code": 0,
+  "seconds": 5.096,
+  "log": "/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/isolated-pools-before.log",
+  "log_sha256": "f014a1a72dda7b973cd1e0b7e77c70b470eeebca0d04805d98f07c2622c87b1e"
+}
@@ -0,0 +1,2 @@
+Checking dependencies
+Building Silo binary to './silo'
@@ -0,0 +1,7 @@
+Running lint check
+0 issues.
+typos binary is not found.. skipping..
+compatibility manifest: imports=119 env=428 metrics=19 headers=87 routes=224 roots=1 grid=3 storage=16 policy=59 brand=181 sha256=ad05829578cf879b462a12fa65f3c10c8c7c6aa8d6c329e04779459eec2645be
+Silo rebrand compatibility baseline is unchanged
+Silo delivery and runtime rebrand checks passed
+docker entrypoint argv compatibility tests passed
@@ -0,0 +1,66 @@
+{
+  "candidate": "055030ea53ca92ee22ce1e601ef4757c247edde8",
+  "base": "9f3037e941a49ab4cd8a0eed7c0f01083fbe4bbe",
+  "requested_model": "claude-opus-5",
+  "requested_effort": "max",
+  "cli_version": "2.1.270",
+  "command": [
+    "/opt/homebrew/bin/claude",
+    "--print",
+    "--model",
+    "claude-opus-5",
+    "--effort",
+    "max",
+    "--safe-mode",
+    "--permission-mode",
+    "plan",
+    "--tools",
+    "Read,Grep,Glob",
+    "--strict-mcp-config",
+    "--no-session-persistence",
+    "--add-dir",
+    "/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab",
+    "--add-dir",
+    "/Users/vonng/pgsty/silo",
+    "--output-format",
+    "stream-json",
+    "--verbose"
+  ],
+  "source_sha256": {
+    "cmd/bucket-replication-utils.go": "365641c760901641e8320cc5123697ab92a46f1add612048b991ed2d1cfad43b",
+    "cmd/bucket-replication.go": "2e766c5946dcabaea79455b50a8e426f404e55c92dcbccbe28d55906e2e43843",
+    "cmd/common-main.go": "f8777fe8a07d175aceee07b4dd13792b2384449c404c004c38a06893be997843",
+    "cmd/erasure-object.go": "4bc848685ea714d88cabbd5d1b8585fbcc06f7b19c775e1a811030e783d0e1a4",
+    "cmd/erasure-server-pool-consistency.go": "d2736ef6bffbb5c5758eba8df38f8d4ecb888a838ab0de8ad3cf015c051f8ad7",
+    "cmd/erasure-server-pool.go": "87ad0b25dfa3081d0e63d0073b788614a9c88e2498a2ce0956b93f8a0a03ef53",
+    "cmd/object-handlers-common.go": "101bd7d7447072d13fed50983b69b562e4725632645e623d7fdd490f388ecdec",
+    "cmd/object-handlers.go": "61897a260f3f5f660f41edcb50956c60e914ef98f9a987da824f16d78171fde2",
+    "cmd/object-multipart-handlers.go": "d9622c69c540ab32dd23916e3f534b6886473a98370c9dd17673e69a423b2a7e",
+    "cmd/replication-delete-marker_test.go": "d967787804d558ac6266b113228fdf4a4f9fcb7cab39138a4fb07558814ccca4",
+    "cmd/replication-delete-mrf_test.go": "5e160f7e19cbbb8cd5fa4e7ffd9cff9e09361b3fc4c5ee5ae61458f99c777781",
+    "cmd/replication-delete-operation_test.go": "2888a04a543324776041316de2821f388d28c3c1a6f5d0031e5ac9d34f58d504",
+    "cmd/replication-tagging-order_test.go": "c8260b4ccf82fa615e1e24b35a07f2d1aacbcf776e5c6f9dadffea4a09ad6ea8",
+    "cmd/replication-tagging-sender_test.go": "3770a1a48a6efe58fe8127e1e4fdf6bd7cf171e17db20f15222ea2f7b85db1af",
+    "cmd/server-main.go": "04c265de211412ba0297396928096d7f2d971244a957a3126154846035263514",
+    "cmd/server_deadline_config_test.go": "1013157f83baa5f7882ec2d41c7b1fccb9e05fb418d0fa61263953037c9698c4",
+    "internal/deadlineconn/deadlineconn.go": "b9272ef640f1d4403b3d0af6cdbaba9186c51ad9a0226dfe449e8ef738e1ec4b",
+    "internal/deadlineconn/deadlineconn_strict_test.go": "f405690c9ff044595f48323d68f4a9b33ce695b3ad6820f54f17151067bfae5e",
+    "internal/http/dial_deadline_linux_test.go": "0939d05b72a09760d53fcdf249775989e3f89bca824b9961d0b2a657ebfdf41e",
+    "internal/http/listener.go": "49628575367f6ab9b6986caf594726d74d370f7d2ac4eed582903600b6eb3fa2",
+    "internal/http/server.go": "b7b0355f2781f8c5f7c77bc910cd4180cd3e5f22a87de41bd35ef119d36b4cdf",
+    "internal/http/server_deadline_test.go": "a6e687b3904a876fa92a4c5b86453159f3e5a38a4b9412dc213c7772f47fbf0b"
+  },
+  "diff_sha256": "d8c4e60f9e4a5b1338f3e6e07b758b1bb279db80eec26847e3b35fde0d049485",
+  "prompt_sha256": "f95edcf71afedceab190ff57bfbec812b06c8c18b5370d887131a760228c2b2c",
+  "started_at": "2026-09-15T16:41:37.757693+00:00",
+  "status": "completed",
+  "exit_code": 0,
+  "actual_models": [
+    "claude-opus-5"
+  ],
+  "finished_at": "2026-09-15T16:53:09.761932+00:00",
+  "raw_sha256": "3e1a45ebdf3f4420fb05647bb383c00d0a86452a6c357a92679485c99d8f4eb3",
+  "stderr_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "result_subtype": "success",
+  "is_error": false
+}
@@ -0,0 +1,18 @@
+Independently review the complete SILO R4-R8 integration candidate for a user-authorized merge to main. You are the real Claude Opus reviewer; provide your own conclusion from source inspection. Read-only: no edits, no GitHub actions, no test execution claims.
+
+Exact candidate: 055030ea53ca92ee22ce1e601ef4757c247edde8; integration branch codex/merge-r4-r8. Base: 9f3037e941a49ab4cd8a0eed7c0f01083fbe4bbe, already contains separately reviewed and CI-accepted R4 (SSE-KMS tag timestamp) and R7 (replication metadata/aws-chunked). This candidate adds the final R5, R6, and R8 local repairs, cherry-picked without conflicts and with provenance/DCO preserved.
+
+Read /Users/vonng/pgsty/silo/AGENTS.md and CONTRIBUTING.md. The maintained PGSTY stack is the release target; upstream MinIO compatibility is best effort. Read /Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/integration-code.diff and /Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/reviewed-source.json, then inspect complete relevant functions and tests in this worktree. Each repair already has real same-version Opus plan consensus: docs/investigations/r5/plan-v2.md and consensus.md; r6/plan-v3.md and consensus.md; r8/plan-v2.md and consensus.md. Prior implementation reviews and validation reports are supporting evidence, not substitutes for this integration review. The R6 v2 multi-target parser proof was disproved by a real storage counterexample and fixed only after v3 consensus; verify the final empty creation-update invariant.
+
+Focus on concrete integration correctness:
+1. R5 tag revision persistence and empty/nonempty ordering through COPY, PUT, multipart, retries and source ACK, with R6 purge/MRF state writes and shared bucket-replication.go functions.
+2. R7 restores only six replication-specific fields. Verify tag values/timestamps remain handled correctly and aws-chunked is not reintroduced, including R4 KMS options.
+3. R6 marker creation versus canonical/legacy purge, all exits, per-target statistics, disk creation/replica metadata preservation, identity-checked marker 405 recovery, retry counts and bounded scanner fallback.
+4. R8 absolute request-header deadlines and CLI/env propagation, HTTP/1 streaming bodies, keep-alive/TLS/h2 boundaries, default DeadlineConn callers and effects on replication I/O.
+5. Full-package test global state, cleanup/initialization ordering and any compile/dependency conflicts that separate scoped tests would miss.
+
+Current local make verifiers is running; full candidate runtime tests and actual PR CI are still pending. Do not label them as passed. The host previously had ENOSPC; it now has more than 700 GiB free, so standard full-package tests can run without capacity overlays. Historical reports accurately retain earlier environment limits and incomplete multi-process deployment acceptance.
+
+Two new R6 and four new R8 test files have boilerplate copyright headers queued for repository-policy normalization, after confirming original authorship. They will be header-only changes with package-and-body byte equivalence checked; do not conflate them with production semantic edits. Any actual implementation blocker will be fixed and re-reviewed as needed.
+
+Return GO_WITH_NONBLOCKING_NOTES or REQUEST_CHANGES, number of blocking findings, exact candidate identity and inspected scope. For each blocker give path/line, real triggering conditions, impact and smallest compatible correction. Clearly distinguish inherited out-of-scope limitations from newly introduced defects and required CI from optional further deployment tests. Do not invent a blocker merely from absence of production deployment. This request is main merge, not release/deploy.
@@ -0,0 +1,49 @@
+The plan file can't be written (Write is disabled this session), so here is the complete review inline.
+
+# SILO R4–R8 integration review — independent, source-only
+
+**Verdict: GO_WITH_NONBLOCKING_NOTES — 0 blocking findings.**
+
+**Candidate identity:** head `055030ea53ca92ee22ce1e601ef4757c247edde8`, branch `codex/merge-r4-r8`, base `9f3037e941a49ab4cd8a0eed7c0f01083fbe4bbe`, worktree `/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/silo`. Scope of this review is a **main merge**, not a release or deployment. I executed nothing — no tests, no builds; every statement below is from reading source.
+
+**Inspected scope:** `integration-code.diff` in full (3367 lines) and all 22 files in `reviewed-source.json`, then the complete surrounding functions in the worktree: `cmd/bucket-replication.go` (`replicateDelete`, `replicateDeleteToTarget`, `replicateObject`, `replicateAll`, `putReplicationOpts`, `getReplicationAction`, `queueMRFHeal`, `queueReplicaDeleteTask`, `queueMRFSave`, `queueReplicationHeal`), `bucket-replication-utils.go`, `bucket-replication-stats.go`, `xl-storage-format-v2.go DeleteVersion`, `erasure-object.go`, `erasure-multipart.go`, `erasure-server-pool.go`, `erasure-server-pool-consistency.go`, `object-handlers.go`, `object-handlers-common.go`, `object-multipart-handlers.go`, `handler-utils.go`, `object-api-options.go`, `bucket-handlers.go`, `common-main.go`, `server-main.go`, `internal/http/{server,listener}.go`, `internal/deadlineconn/deadlineconn.go`, all six new test files plus the base tests they interact with, `Makefile`, `.golangci.yml`, `AGENTS.md`, `CONTRIBUTING.md`, and the r5/r6/r8 plan + consensus records. Cross-checked against Go 1.27.1 `net/http/server.go` and pinned `minio-go/v7 v7.3.1-0.20260910142817-60bd07042d49`.
+
+## Independent confirmation of the key claims
+
+**R6 final empty creation-update invariant (the disproved-v2 point).** The v2 proof fails exactly as recorded: `replStatusRegex` (`bucket-replication-utils.go:168`) matches `arn1=;arn2=;` yielding `{arn1: ";arn2="}` — non-empty — while single-target `arn1=;` does not match at all. The v3 fix at `bucket-replication.go:575-582` sets `ReplicationStatusInternal=""`, `Targets=nil`, `ReplicaStatus=""`; `CompositeReplicationStatus` (`bucket-replication-utils.go:356-379`) then returns empty via both the internal string and the replica fallback, so `xlMetaV2.DeleteVersion` (`xl-storage-format-v2.go:1396-1405`, `1438-1447`) skips the creation/replica write while still writing `VersionPurgeStatusKey` (`1406-1408`, `1448-1450`). `ReplicationTimeStamp` is therefore inert (consensus N5 holds). I also confirmed the counterexample's precondition independently: `erasure-object.go:2099-2105` leaves `deleteMarker=true` when the stored marker carries no purge status, which is what sets `fi.Deleted=true` and reaches the rewriting branch. COMPLETE purges still remove the version (`1379-1393`, `1457-1459`).
+
+**R6 classification / all exits.** `isVersionPurge()` (`1954-1956`) parses as `VersionID != "" || (DeleteMarkerVersionID != "" && !VersionPurgeStatus().Empty())`. Every live producer emits only one shape (`object-handlers.go:3232-3248`, `bucket-replication.go:3362-3378`, `3814-3836`), and the dir-object `nullVersionID` re-add (`bucket-handlers.go:552-555`, `679-681`) classifies as a purge under both old and new code, so no wire-form change there. All exits of `replicateDeleteToTarget` select the purge field consistently, HEAD probing is creation-only, `ReplicationDeleteMarker` is false for purges. `purgeReplicationStatus` maps only the legacy `COMPLETE` spelling; `ReplicationStats.Update` (`bucket-replication-stats.go:179-237`) consumes the passed status and never `rinfo.ReplicationStatus`, with `ri.Size == 0` giving count-only/zero-byte deltas. The `ResetStatusesMap` nil guard fixes a genuine nil-map assignment panic, since `ObjectToDelete.ReplicationState()` never initialises that map.
+
+**R6 MRF recovery / budget.** `queueMRFHeal:4118-4125` parses as `(err != nil && !validMarker) || oi.Name == ""`; `decodeDirObject` is identity for both `obj` and `dir/`, matching `GetObjectInfo`'s decoded name, and `erasure-server-pool-consistency.go:143-145` is what returns a populated marker `ObjectInfo` with `MethodNotAllowed`. `RetryCount int` matches the persisted `MRFReplicateEntry.RetryCount` and `QueueReplicationHeal`'s parameter — no on-disk format change. All three increment sites feed the existing `> mrfRetryLimit` drop accounting (`3926-3931`), and the scanner fallback restarts with a fresh budget.
+
+**R5 tag revision flow.** Sender: `replicationTaggingTimestamp` (`804-812`) serves both the full retransmit and the metadata-COPY branch, the latter now failing closed symmetrically (`1720-1725`). `getCopyObjMetadata:765-766` always emits `X-Amz-Tagging` (possibly empty) + `REPLACE`; minio-go `copyObjectDo` forwards empty header values; the receiver's `getRequestHeaderOrQueryValue` (`handler-utils.go:160-171`) treats presence-with-empty-value as authoritative — so an ordered deletion is genuinely representable on the wire. Receiver: `CopyObjectHandler:1799-1840` captures the stored stamp before REPLACE rebuilds the map, every branch writes or deletes the key explicitly, and the unconditional `delete(encMetadata, …)` is safe *because* of that, blocking the SSE-C rotation snapshot (`1655-1659`) from re-merging at `1910`. `PutObjectHandler:2323-2325` and `NewMultipartUploadHandler:315-318` mutate the same map that becomes `opts.UserDefined` (`object-api-options.go:451`), and the header is parsed only under trusted replication (`388-396`). Ordering is re-applied under the write lock by the existing `reconcileStoredObjectTags` callers (`erasure-object.go:136-139`, `1312-1315`; `erasure-multipart.go:1161-1189`; `erasure-server-pool.go:1443-1456`) — which is also what keeps the base R4 KMS test's `missing-timestamp` expectation intact. Dropping the `ri.UserTags` re-injection in the source ACK (`1294-1304`) is right: `cleanMetadata` strips the tagging key from `UserDefined`, so stored tags are now left alone, and the pools path re-derives them from merged `UserTags`.
+
+**R7 boundary.** `replicationToInternalHeaders` has exactly six entries (`handler-utils.go:106-114`); `extractReplicationMetadataFromMime` restores only those and re-extracts no ordinary metadata, so the `aws-chunked` normalisation in `extractMetadata:225-241` is not undone. R5 touches neither, and R4's KMS options (`object-api-options.go:449-460`) still carry the three replication timestamps unmodified.
+
+**R8 deadlines.** Against Go 1.27.1: header window set at `server.go:2038`/`2177`, whole-request deadline unconditionally at `1103`, `StateActive` at `2056-2058` firing after *every* successful `readRequest` because `readRequest` calls `setInfiniteReadLimit()` at `1067`. That is the one place where the naive reading of the `c.r.remain` comment is wrong — the pipelined/fully-buffered request does get the strict→rolling flip, so consensus N2 is correct. `startBackgroundRead` (`741`) and `hijackLocked` zero the deadline, which `infReads` honours — that is why background reads and hijacked grid/websocket conns still work. The strict cap only shortens, never extends; zero/past semantics unchanged; `readExplicit`/`readDeadlineStrict` only touched under `mu`. The h2 skip is defensive rather than load-bearing (net/http uses `skipHooks` for ALPN h2; the h2 server zeroes the conn deadline), and a nil `raw` fails the type assertion safely. Strict mode is opt-in, so every other `DeadlineConn` caller — the optional Linux internode dialer (`dial_linux.go:126-131`, currently disabled at `server-main.go:422`) and all outbound replication transports — keeps legacy rolling reads. The real fix is propagation: flag, field and `UseReadHeaderTimeout` already existed; `ctxt.ReadHeaderTimeout` was simply never populated before `common-main.go:448`.
+
+**Full-package test state.** No duplicate symbols (`tagTestCapacityDisk` defined once in base `erasure-server-pool-tags_test.go:258`); no helper collisions in `internal/http`; `testdata/config/1.yaml`, `fmtGenFlags`, `serverCmd.Flags` all exist; `buildServerCtxt` mutates no globals. Globals are swapped/restored, and `prepareFS`/`prepareErasure`/`initAPIHandlerTest` re-run `initAllSubsystems` between backends, so leaked target-sys entries can't cross a fixture boundary. `logger.UpdateAuditWebhooks(ctx, nil)` really clears the list (`targets.go:227-273`), so the audit fixture is re-enterable across the SD and Erasure passes. `make verifiers` = lint + check-gen + rebrand-guard, and `.golangci.yml` enables no header linter.
+
+## Blocking findings
+
+**None.**
+
+## Non-blocking notes (newly introduced here)
+
+1. `bucket-replication.go:804-812` — an unparseable stored tagging timestamp now fails replication for *untagged* objects too. Trigger: a corrupt/legacy value, or the empty value `erasure-server-pool-consistency.go:211-214` can persist when a non-primary pool holds a malformed stamp. Fail-closed (FAILED + MRF retry), never silent divergence. Optional hardening: treat missing-or-empty as absent, keeping the hard error for non-empty malformed values.
+2. `bucket-replication.go:1031-1036` — any version with a tag revision now resolves to `replicateMetadata` instead of `replicateNone`; since `object-handlers.go:1835-1836` gives every non-replica COPY a revision, large resyncs issue one extra metadata COPY per object. Steady state is unaffected (COMPLETED gate at `3810`). Accepted in r5 consensus; flagged as operational cost.
+3. `bucket-replication.go:435-445`, `551-566`, `1958-1964` — purge audit status changes from legacy `COMPLETE` to `COMPLETED`, and per-target purge outcomes now reach `globalReplicationStats` where the empty creation status previously recorded nothing. Intended (r6 dispositions 1–2); worth one release-note line for audit/metric consumers.
+4. `common-main.go:448` — now that `ReadHeaderTimeout` is populated it also participates in `net/http`'s `tlsHandshakeTimeout()` minimum. No change at defaults (30s vs 30s); a small configured header timeout also shortens the TLS handshake window. Documented in r8 consensus N1.
+5. `replication-tagging-order_test.go:1805-1814` — `TestAPIPoolsTaggingReplicaDeletion` calls `globalBucketMetadataSys.Update` after `consistencyPools`, which (unlike `initAPIHandlerTest`) does not run `initAllSubsystems`; run in isolation with `-run` it would nil-dereference. Harmless in full-package CI. Smallest fix: use `initAPIHandlerTest`, as the neighbouring consistency tests do.
+6. `replication-delete-mrf_test.go:1208-1215` — the audit cleanup cancels targets twice; non-panicking because `SafeClose(nil)` only prints a stack (`internal/ioutil/ioutil.go:463-471`), but it can add stderr noise.
+7. Headers (already queued, header-only): the two new R6 test files use `Copyright (c) 2026 PGSTY` + SPDX-only, and the four new R8 test files carry `Copyright (c) 2015-2021 MinIO, Inc.` despite being new original work; CONTRIBUTING.md asks new original files to name their actual holders with AGPL boilerplate (the two new R5 files already comply). No verifier enforces headers, so this does not gate CI and is distinct from production semantics.
+
+## Inherited / out-of-scope limitations (not introduced by this candidate)
+
+Purge-target subset merging under narrowed fan-out; nil/missing target clients cannot restore already-lost tracking; the `ResetStatusesMap` key asymmetry between `targetResetHeader(arn)` writes and bare-`arn` reads (`bucket-replication-utils.go:392-399` vs `419-426`) — the candidate only adds the panic-preventing nil guard; the shared `replStatusRegex` still mis-parses serialized empty statuses (R6 deliberately works around it at the write site); unqualified (no `versionId`) replica PUT has no stored-tag reconcile (`object-handlers.go:2442`); TLS handshake *write* deadlines keep rolling behaviour (r8 N9); historical objects without a revision, tag-filter target selection and real multi-site clock skew remain unsolved (r5 consensus).
+
+## Verification still owed (I ran nothing; nothing below is "passed")
+
+**Required for this merge — repository gates only:** `make verifiers` (lint, check-gen, rebrand-guard), `make build` producing `silo`, and full-package tests, at minimum `./cmd`, `./internal/http`, `./internal/deadlineconn`; a Linux CI leg to compile and run the build-tagged `TestInternodeDialReadDeadline`; DCO sign-off/authorship checks on the cherry-picked commits. With >700 GiB free, no capacity overlay is needed.
+
+**Optional, explicitly not a merge gate:** `SILO_TEST_LONG_UPLOAD=1` (>30s default-idle transfer regressions), multi-process/multi-node deployment acceptance, cross-region replication mesh. Their absence is a coverage boundary, not a defect; I do not treat missing production deployment as a blocker.
@@ -0,0 +1,27 @@
+{
+  "binary": "/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/silo/silo",
+  "binary_sha256": "1cc536f1a3c8d8372ff2d5b140b1fd2bc98a299324fea0f73f67288d48104ce4",
+  "expected_rejection": true,
+  "cases": [
+    {
+      "source": "flag",
+      "header_timeout_ms": 100,
+      "idle_timeout_ms": 2000,
+      "header_completion_delay_ms": 400,
+      "rejected": true,
+      "status": "",
+      "elapsed_seconds": 0.403,
+      "still_alive": true
+    },
+    {
+      "source": "environment",
+      "header_timeout_ms": 100,
+      "idle_timeout_ms": 2000,
+      "header_completion_delay_ms": 400,
+      "rejected": true,
+      "status": "",
+      "elapsed_seconds": 0.402,
+      "still_alive": true
+    }
+  ]
+}
@@ -0,0 +1,12 @@
+{
+  "command": [
+    "python3",
+    "docs/investigations/r8/evidence/runtime_probe.py",
+    "/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/silo/silo",
+    "fixed",
+    "/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/runtime-probe"
+  ],
+  "exit_code": 0,
+  "seconds": 1.638,
+  "stdout_sha256": "e493d9757c130c2531072dc0eaee42b8fc1fa0f45fc43d0d0e098aac55f0d387"
+}
@@ -0,0 +1,6 @@
+silo version DEVELOPMENT.2026-09-15T16-44-34Z (commit-id=80684fed59f556d579e268c5a855d936c1347b68)
+Runtime: go1.27.1 darwin/arm64
+License: GNU AGPLv3 - https://www.gnu.org/licenses/agpl-3.0.html
+Copyright: 2015-2025 MinIO, Inc.
+Modifications: Copyright 2025-2026 PGSTY
+Source compatibility: based on MinIO technology
@@ -0,0 +1,3 @@
+ok  	github.com/minio/minio/cmd	13.654s
+ok  	github.com/minio/minio/internal/deadlineconn	2.528s
+ok  	github.com/minio/minio/internal/http	14.301s
@@ -0,0 +1,175 @@
+{
+  "head": "80684fed59f556d579e268c5a855d936c1347b68",
+  "baseline": "9f3037e941a49ab4cd8a0eed7c0f01083fbe4bbe",
+  "source_sha256": {
+    "cmd/bucket-replication-utils.go": "365641c760901641e8320cc5123697ab92a46f1add612048b991ed2d1cfad43b",
+    "cmd/bucket-replication.go": "2e766c5946dcabaea79455b50a8e426f404e55c92dcbccbe28d55906e2e43843",
+    "cmd/common-main.go": "f8777fe8a07d175aceee07b4dd13792b2384449c404c004c38a06893be997843",
+    "cmd/erasure-object.go": "4bc848685ea714d88cabbd5d1b8585fbcc06f7b19c775e1a811030e783d0e1a4",
+    "cmd/erasure-server-pool-consistency.go": "d2736ef6bffbb5c5758eba8df38f8d4ecb888a838ab0de8ad3cf015c051f8ad7",
+    "cmd/erasure-server-pool.go": "87ad0b25dfa3081d0e63d0073b788614a9c88e2498a2ce0956b93f8a0a03ef53",
+    "cmd/object-handlers-common.go": "101bd7d7447072d13fed50983b69b562e4725632645e623d7fdd490f388ecdec",
+    "cmd/object-handlers.go": "61897a260f3f5f660f41edcb50956c60e914ef98f9a987da824f16d78171fde2",
+    "cmd/object-multipart-handlers.go": "d9622c69c540ab32dd23916e3f534b6886473a98370c9dd17673e69a423b2a7e",
+    "cmd/replication-delete-marker_test.go": "d967787804d558ac6266b113228fdf4a4f9fcb7cab39138a4fb07558814ccca4",
+    "cmd/replication-delete-mrf_test.go": "6fcfaf505d28f98e42dff9c0d965895be2c2d112e9e996220d424aea1f76d691",
+    "cmd/replication-delete-operation_test.go": "2e674cab5ca4dbc38cb2c1ddcca117269276e6419e1869c154c3bd6a05676715",
+    "cmd/replication-tagging-order_test.go": "c8260b4ccf82fa615e1e24b35a07f2d1aacbcf776e5c6f9dadffea4a09ad6ea8",
+    "cmd/replication-tagging-sender_test.go": "3770a1a48a6efe58fe8127e1e4fdf6bd7cf171e17db20f15222ea2f7b85db1af",
+    "cmd/server-main.go": "04c265de211412ba0297396928096d7f2d971244a957a3126154846035263514",
+    "cmd/server_deadline_config_test.go": "a8259d273922a8973b44d9a468791761d373fe265fff8b2b53871e4626b11405",
+    "internal/deadlineconn/deadlineconn.go": "b9272ef640f1d4403b3d0af6cdbaba9186c51ad9a0226dfe449e8ef738e1ec4b",
+    "internal/deadlineconn/deadlineconn_strict_test.go": "b4aec28c5daddb36e6ebb98dd8af2a44b7a2c48f0660068534f69669609f67a7",
+    "internal/http/dial_deadline_linux_test.go": "c4c83bda92ba9bac53166453920456134b3d8265cd59101b4203067c67eca59e",
+    "internal/http/listener.go": "49628575367f6ab9b6986caf594726d74d370f7d2ac4eed582903600b6eb3fa2",
+    "internal/http/server.go": "b7b0355f2781f8c5f7c77bc910cd4180cd3e5f22a87de41bd35ef119d36b4cdf",
+    "internal/http/server_deadline_test.go": "87303cc389bf1cf759898489f06b001073de2dd9c4b3687c4eca14aa186b62ab"
+  },
+  "no_capacity_overlay": true,
+  "race_test_selection": [
+    "TestAPILocalTaggingAlwaysAdvancesRevision",
+    "TestAPIPoolsTaggingReplicaDeletion",
+    "TestAPITaggingMultipartCommitRechecksRevision",
+    "TestAPITaggingReplicationOrdering",
+    "TestAPITaggingReplicationOrderingKMS",
+    "TestAPITaggingSSECRotationPreservesDeletionRevision",
+    "TestAPITaggingUnqualifiedCopyOrdering",
+    "TestConcurrentStrictReadDeadline",
+    "TestDefaultReadDeadlineStillRenews",
+    "TestInternodeDialReadDeadline",
+    "TestLocalTaggingCommitCannotRegressRevision",
+    "TestReplicateDeleteMarkerPurge",
+    "TestReplicateDeleteMarkerTargetSemantics",
+    "TestReplicateDeleteOperationExits",
+    "TestReplicateDeletePurgeMissingTargetState",
+    "TestReplicationDeleteQueueFullRetryBudget",
+    "TestReplicationMRFMarkerRecovery",
+    "TestServerBackgroundReadNoDeadline",
+    "TestServerConnStateHook",
+    "TestServerContinuousDownload",
+    "TestServerContinuousUpload",
+    "TestServerDefaultIdleLongDownload",
+    "TestServerDefaultIdleLongUpload",
+    "TestServerEarlyBodyClose",
+    "TestServerHTTP2Deadlines",
+    "TestServerHijackedDeadline",
+    "TestServerIdleBodyDeadline",
+    "TestServerKeepAliveDeadline",
+    "TestServerPipelinedDeadline",
+    "TestServerReadHeaderDeadline",
+    "TestServerReadHeaderTimeoutConfig",
+    "TestServerTLSHandshakeReadDeadline",
+    "TestStrictExpiredFutureReadDeadline",
+    "TestStrictReadDeadline",
+    "TestStrictReadDeadlineRepeatedRenewal",
+    "TestTaggingProductionCopyWireShape",
+    "TestTaggingRepeatedValueNeedsRevisionDelivery",
+    "TestTaggingReplicaContentDuplicateGuard",
+    "TestTaggingReplicationSenderRetryAndAcknowledgment",
+    "TestTaggingTimestampWire"
+  ],
+  "started_at": "2026-09-15T16:45:09.640646+00:00",
+  "checks": [
+    {
+      "name": "make-verifiers-final",
+      "command": [
+        "make",
+        "verifiers",
+        "GOLANGCI=/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/golangci-serial"
+      ],
+      "env": {
+        "GOMAXPROCS": "4",
+        "GOFLAGS": "-p=2",
+        "MINIO_API_REQUESTS_MAX": "10000"
+      },
+      "exit_code": 0,
+      "seconds": 76.933,
+      "log": "/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/make-verifiers-final.log",
+      "log_sha256": "54c906cff1d33d0148fbc4cac918c0785a3bcc8f7a4eb7e04a2f774c2f010bb4"
+    },
+    {
+      "name": "make-build",
+      "command": [
+        "make",
+        "build"
+      ],
+      "env": {
+        "GOMAXPROCS": "4",
+        "GOFLAGS": "-p=2",
+        "MINIO_API_REQUESTS_MAX": "10000"
+      },
+      "exit_code": 0,
+      "seconds": 19.366,
+      "log": "/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/make-build.log",
+      "log_sha256": "6ba9b545236be964861749c72e7609edf12b8f470df30d1ede8fd62f497e629b"
+    },
+    {
+      "name": "silo-version",
+      "command": [
+        "./silo",
+        "--version"
+      ],
+      "env": {
+        "GOMAXPROCS": "4",
+        "GOFLAGS": "-p=2",
+        "MINIO_API_REQUESTS_MAX": "10000"
+      },
+      "exit_code": 0,
+      "seconds": 1.259,
+      "log": "/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/silo-version.log",
+      "log_sha256": "ada27f2be570c33df5712e86782a7be2ce3acfef54c8bb22a9230db3606513af"
+    },
+    {
+      "name": "full-tests",
+      "command": [
+        "go",
+        "test",
+        "-p",
+        "2",
+        "./cmd",
+        "./internal/...",
+        "-count=1",
+        "-timeout=30m"
+      ],
+      "env": {
+        "GOMAXPROCS": "4",
+        "GOFLAGS": "-p=2",
+        "MINIO_API_REQUESTS_MAX": "10000",
+        "CGO_ENABLED": "0"
+      },
+      "exit_code": 0,
+      "seconds": 340.193,
+      "log": "/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/full-tests.log",
+      "log_sha256": "24b986e2f5aef0e668116abaab5024bf19ac664aec010ca7aa5ef56886f47ad1"
+    },
+    {
+      "name": "targeted-race",
+      "command": [
+        "go",
+        "test",
+        "-race",
+        "-p",
+        "2",
+        "./cmd",
+        "./internal/deadlineconn",
+        "./internal/http",
+        "-run",
+        "^(TestAPILocalTaggingAlwaysAdvancesRevision|TestAPIPoolsTaggingReplicaDeletion|TestAPITaggingMultipartCommitRechecksRevision|TestAPITaggingReplicationOrdering|TestAPITaggingReplicationOrderingKMS|TestAPITaggingSSECRotationPreservesDeletionRevision|TestAPITaggingUnqualifiedCopyOrdering|TestConcurrentStrictReadDeadline|TestDefaultReadDeadlineStillRenews|TestInternodeDialReadDeadline|TestLocalTaggingCommitCannotRegressRevision|TestReplicateDeleteMarkerPurge|TestReplicateDeleteMarkerTargetSemantics|TestReplicateDeleteOperationExits|TestReplicateDeletePurgeMissingTargetState|TestReplicationDeleteQueueFullRetryBudget|TestReplicationMRFMarkerRecovery|TestServerBackgroundReadNoDeadline|TestServerConnStateHook|TestServerContinuousDownload|TestServerContinuousUpload|TestServerDefaultIdleLongDownload|TestServerDefaultIdleLongUpload|TestServerEarlyBodyClose|TestServerHTTP2Deadlines|TestServerHijackedDeadline|TestServerIdleBodyDeadline|TestServerKeepAliveDeadline|TestServerPipelinedDeadline|TestServerReadHeaderDeadline|TestServerReadHeaderTimeoutConfig|TestServerTLSHandshakeReadDeadline|TestStrictExpiredFutureReadDeadline|TestStrictReadDeadline|TestStrictReadDeadlineRepeatedRenewal|TestTaggingProductionCopyWireShape|TestTaggingRepeatedValueNeedsRevisionDelivery|TestTaggingReplicaContentDuplicateGuard|TestTaggingReplicationSenderRetryAndAcknowledgment|TestTaggingTimestampWire)$",
+        "-count=1",
+        "-timeout=15m"
+      ],
+      "env": {
+        "GOMAXPROCS": "4",
+        "GOFLAGS": "-p=2",
+        "MINIO_API_REQUESTS_MAX": "10000",
+        "CGO_ENABLED": "1"
+      },
+      "exit_code": 0,
+      "seconds": 46.286,
+      "log": "/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/targeted-race.log",
+      "log_sha256": "7d021e57e513ea81617df44a6253703622145bf5e72e6180de84c2bd3c7186d3"
+    }
+  ],
+  "source_unchanged": true,
+  "finished_at": "2026-09-15T16:53:13.682876+00:00"
+}
@@ -0,0 +1,59 @@
+{
+  "baseline": "9f3037e941a49ab4cd8a0eed7c0f01083fbe4bbe",
+  "reviewed_code_commit": "055030ea53ca92ee22ce1e601ef4757c247edde8",
+  "tested_commit": "80684fed59f556d579e268c5a855d936c1347b68",
+  "integration_branch": "codex/merge-r4-r8",
+  "current_source_matches_tested_commit": true,
+  "production_or_test_body_changes_after_review": false,
+  "source_sha256": {
+    "cmd/bucket-replication-utils.go": "365641c760901641e8320cc5123697ab92a46f1add612048b991ed2d1cfad43b",
+    "cmd/bucket-replication.go": "2e766c5946dcabaea79455b50a8e426f404e55c92dcbccbe28d55906e2e43843",
+    "cmd/common-main.go": "f8777fe8a07d175aceee07b4dd13792b2384449c404c004c38a06893be997843",
+    "cmd/erasure-object.go": "4bc848685ea714d88cabbd5d1b8585fbcc06f7b19c775e1a811030e783d0e1a4",
+    "cmd/erasure-server-pool-consistency.go": "d2736ef6bffbb5c5758eba8df38f8d4ecb888a838ab0de8ad3cf015c051f8ad7",
+    "cmd/erasure-server-pool.go": "87ad0b25dfa3081d0e63d0073b788614a9c88e2498a2ce0956b93f8a0a03ef53",
+    "cmd/object-handlers-common.go": "101bd7d7447072d13fed50983b69b562e4725632645e623d7fdd490f388ecdec",
+    "cmd/object-handlers.go": "61897a260f3f5f660f41edcb50956c60e914ef98f9a987da824f16d78171fde2",
+    "cmd/object-multipart-handlers.go": "d9622c69c540ab32dd23916e3f534b6886473a98370c9dd17673e69a423b2a7e",
+    "cmd/replication-delete-marker_test.go": "d967787804d558ac6266b113228fdf4a4f9fcb7cab39138a4fb07558814ccca4",
+    "cmd/replication-delete-mrf_test.go": "6fcfaf505d28f98e42dff9c0d965895be2c2d112e9e996220d424aea1f76d691",
+    "cmd/replication-delete-operation_test.go": "2e674cab5ca4dbc38cb2c1ddcca117269276e6419e1869c154c3bd6a05676715",
+    "cmd/replication-tagging-order_test.go": "c8260b4ccf82fa615e1e24b35a07f2d1aacbcf776e5c6f9dadffea4a09ad6ea8",
+    "cmd/replication-tagging-sender_test.go": "3770a1a48a6efe58fe8127e1e4fdf6bd7cf171e17db20f15222ea2f7b85db1af",
+    "cmd/server-main.go": "04c265de211412ba0297396928096d7f2d971244a957a3126154846035263514",
+    "cmd/server_deadline_config_test.go": "a8259d273922a8973b44d9a468791761d373fe265fff8b2b53871e4626b11405",
+    "internal/deadlineconn/deadlineconn.go": "b9272ef640f1d4403b3d0af6cdbaba9186c51ad9a0226dfe449e8ef738e1ec4b",
+    "internal/deadlineconn/deadlineconn_strict_test.go": "b4aec28c5daddb36e6ebb98dd8af2a44b7a2c48f0660068534f69669609f67a7",
+    "internal/http/dial_deadline_linux_test.go": "c4c83bda92ba9bac53166453920456134b3d8265cd59101b4203067c67eca59e",
+    "internal/http/listener.go": "49628575367f6ab9b6986caf594726d74d370f7d2ac4eed582903600b6eb3fa2",
+    "internal/http/server.go": "b7b0355f2781f8c5f7c77bc910cd4180cd3e5f22a87de41bd35ef119d36b4cdf",
+    "internal/http/server_deadline_test.go": "87303cc389bf1cf759898489f06b001073de2dd9c4b3687c4eca14aa186b62ab"
+  },
+  "compatibility_inventory_sha256": "208c78a9e9fc98d6de7f1e0f03cfec97d8491df65ad4de3d88f04c36c555f819",
+  "evidence_sha256": {
+    "evidence/full-tests.log": "24b986e2f5aef0e668116abaab5024bf19ac664aec010ca7aa5ef56886f47ad1",
+    "evidence/header-equivalence.json": "0aee56aa978515579aa59215152b685f614cd5bda323fe26690a4c21f837f109",
+    "evidence/integration-equivalence.json": "473711fa8660504275242b70e80622277a32c73e0c7df1de6f5ba2d6bbfcc54e",
+    "evidence/isolated-pools-before.log": "f014a1a72dda7b973cd1e0b7e77c70b470eeebca0d04805d98f07c2622c87b1e",
+    "evidence/isolated-pools-before.result.json": "3a761d8a6fd1869a9a9d2b3d506ddec4fdaaad098da2b6a2f85252acf9561774",
+    "evidence/make-build.log": "6ba9b545236be964861749c72e7609edf12b8f470df30d1ede8fd62f497e629b",
+    "evidence/make-verifiers-final.log": "54c906cff1d33d0148fbc4cac918c0785a3bcc8f7a4eb7e04a2f774c2f010bb4",
+    "evidence/opus-integration.metadata.json": "c468e952e2364625ffe04a7221489185705857ad073f6fdb8dee3fe6aad9345c",
+    "evidence/opus-integration.prompt.md": "f95edcf71afedceab190ff57bfbec812b06c8c18b5370d887131a760228c2b2c",
+    "evidence/opus-review.md": "463f6b97e8d19929187242724e6bcfc2406217cd82702739716b65e19a8f2360",
+    "evidence/runtime-probe.json": "e493d9757c130c2531072dc0eaee42b8fc1fa0f45fc43d0d0e098aac55f0d387",
+    "evidence/runtime-probe.result.json": "d8703c201493cf865d758d53cbc6d92b71535345dafe3c2f27ca2a29ad53e353",
+    "evidence/silo-version.log": "ada27f2be570c33df5712e86782a7be2ce3acfef54c8bb22a9230db3606513af",
+    "evidence/targeted-race.log": "7d021e57e513ea81617df44a6253703622145bf5e72e6180de84c2bd3c7186d3",
+    "evidence/validation-results.json": "29182a752a8ffb75367e8cce51e1f2ef080e453a059248ae2c868aa66627aede"
+  },
+  "original_raw_review": {
+    "path": "/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/opus-integration.jsonl",
+    "sha256": "3e1a45ebdf3f4420fb05647bb383c00d0a86452a6c357a92679485c99d8f4eb3"
+  },
+  "original_review_diff": {
+    "path": "/Users/vonng/tmp/silo-r4-r8-main-20260916-01a0a5ab/integration-code.diff",
+    "sha256": "d8c4e60f9e4a5b1338f3e6e07b758b1bb279db80eec26847e3b35fde0d049485"
+  },
+  "scope": "Local integration validation and independent source review. Final PR checks and remote merge are recorded separately."
+}
@@ -0,0 +1,17 @@
+# R5 investigation baseline
+
+- Worktree: `/Users/vonng/.codex/worktrees/77ad/silo`
+- HEAD: `9ebe81c1b3611f9cc73e676b5b741c2be62c467a`; GitHub main checked live on 2026-09-15.
+- Branch: `codex/r5-tag-deletion-ordering`.
+- WORKFLOW: `/Users/vonng/tmp/silo-r4-r8-20260915-01a0a5ab/WORKFLOW.md` read completely.
+- This isolated worktree has no AGENTS.md. Read `/Users/vonng/pgsty/silo/AGENTS.md`: PGSTY supported stack, minimal compatible changes, separate local/merge/release gates.
+- Existing tag storage reconciliation is already in HEAD; inspect and reuse it.
+- No open R5 PR in live `gh pr list`; unrelated open PRs #184 and #187 belong to R6/R7.
+- Parent reproduction: `/Users/vonng/tmp/silo-r4-r8-20260915-01a0a5ab/baseline-evidence/r5-handler.log`.
+- Current reproduction overlay and raw output: `/Users/vonng/tmp/silo-r5-20260915-77ad/`.
+- Claude Code actual version: 2.1.270 at `/opt/homebrew/bin/claude`. Required model `claude-opus-5`, effort `max`; model identity must be checked in assistant messages.
+- Toolchain: go1.27.1 darwin/arm64. Targeted tests use GOMAXPROCS=2 and -p 1 to share the host.
+
+## Ownership
+
+R4 owns `cmd/object-api-options.go` KMS common-field preservation and option tests. R5 does not edit that file. R5 owns tag state generation, wire propagation, COPY/PUT/multipart persistence and ordered replay tests. Coordination requested through parent while R4 actual task ID is pending.
@@ -0,0 +1,32 @@
+# R5 plan consensus
+
+Date: 2026-09-15. Research base: `9ebe81c1b3611f9cc73e676b5b741c2be62c467a`.
+
+## Accepted plan
+
+- Version: **v2**, `plan-v2.md`.
+- SHA256: `5a782acf3f285b23d1ae43a73481c4eb772a9a6d917fc5a550ecfc7cbf7446ca`.
+- Actual reviewer: **claude-opus-5**, explicitly invoked **--effort max** through `/opt/homebrew/bin/claude` 2.1.270. All assistant messages in both reviews identify this model. The auxiliary Haiku usage in CLI bookkeeping is separately retained in modelUsage and is not the reviewer.
+- Actual result: **APPROVE_WITH_NONBLOCKING_NOTES; 0 blocking items** in opus-v2-review.md.
+- Codex accepts this exact v2 and its bounded per-hop scope. Plan hash was checked locally immediately before implementation. Opus's read-only tools did not run hashing; the original caveat is retained in raw review.
+- Workflow permission: after this written consensus, local implementation and verification proceed without another user approval. No main merge, remote push, release, deployment or production state rewrite.
+
+## Discussion and resolved differences
+
+V1 was REQUEST_CHANGES with five blockers. See opus-v1-response.md for individual treatment and source evidence. V2 resolves all five. Opus explicitly withdrew its empty-only transfer proposal after the same-value re-addition counterexample, corrected its KMS COPY statement after inspecting bucket-default/auto encryption, and accepted that per-pool-only local clock guards are insufficient for ordinary source reads.
+
+## Nonblocking notes accepted during implementation
+
+- Extra metadata I/O occurs on scheduled metadata/heal/existing-object work with a recorded revision; ordinary object replication dispatches straight to full transfer. Completed scanner gates and incoming replication suppression avoid a feedback loop. Test the incoming no-reschedule decision.
+- Pin unchanged object ModTime for local tagging changes.
+- Keep a single-set monotonic guard and one uniform multi-pool candidate; direct-to-set writes outside the pool lock can transiently differ and re-converge on the next pooled mutation.
+- Check actual failed COPY status/action and subsequent retry. Malformed timestamps fail both PUT and metadata COPY construction.
+- Preserve scope limitations: tag-filter target selection, historical missing revisions, arbitrary unversioned content overwrites, and real multi-site/host-clock skew are not solved or production-accepted here.
+
+## R4 dependency
+
+Reuse reviewed local R4 commit `dbcf8dec589deb5d91e17d295cb70997635f5b55` on this isolated branch before implementation. Its only production change is the KMS options field, already examined against the provided patch SHA256 `2d4806d986bbd94ba4bc3951f3aeee48401ee1921c28ded0988fa09ca76ca26f`. R5 does not reimplement or modify that field. This makes R4+R5 tests run on actual combined source, with R5's eventual commit measured against the R4 dependency.
+
+## Raw records
+
+`/Users/vonng/tmp/silo-r5-20260915-77ad/opus-v1.jsonl`, `opus-v1.stderr.log`, `opus-v1-request.json`, and matching `opus-v2.*`. In-repository review texts, prompts and metadata preserve plan hashes, model identity, usage and verdicts. V1 failure is not treated as approval.
@@ -0,0 +1,35 @@
+{
+  "tested_dependency": "dbcf8dec589deb5d91e17d295cb70997635f5b55",
+  "merged_dependency": "af2b1794d38d9e70e1d2c3ee692426e4b6cab4bd",
+  "pr": "https://github.com/pgsty/silo/pull/193",
+  "files": {
+    "cmd/object-api-options.go": {
+      "tested_sha256": "25e2e9484fafd94d1b2c857b94373758e481893ad93fb1a063edf7746277accc",
+      "merged_sha256": "25e2e9484fafd94d1b2c857b94373758e481893ad93fb1a063edf7746277accc",
+      "package_body_sha256": "23fa2a25307bf1e41b665217a3f39aa7a8b860686a54209092fa9c0f1f13243a",
+      "package_body_identical": true
+    },
+    "cmd/object-api-options-replication_test.go": {
+      "tested_sha256": "1ea2a060987e32a4c76fce96ee974df475944c2d6ab482a4893e33daf7bca849",
+      "merged_sha256": "c21fc8889a079085d9a882499a1cbe868278a3517580651f3bed1102e2a6aef8",
+      "package_body_sha256": "1a57a47bdd370042fa0f0d2d90efe447abedee9b9ef48a938d4bed631d83ec0b",
+      "package_body_identical": true
+    },
+    "cmd/object-copy-replication-tagging_test.go": {
+      "tested_sha256": "5437a77e68736b4ce69de9c777675251fef24b0352dfe30bd8a836fc7ee810e3",
+      "merged_sha256": "73f066ed7258d430f078ecc90e551ece878bd3d4672bc762094d434ff8fec23d",
+      "package_body_sha256": "ef77de91cd91d1bd1c3cb10e4fee171c724c4f548749a23c7e48dcfcfb6a1585",
+      "package_body_identical": true
+    }
+  },
+  "other_changes": [
+    "cmd/object-api-options-replication_test.go",
+    "cmd/object-copy-replication-tagging_test.go",
+    "docs/investigations/r4/implementation-review.md",
+    "docs/investigations/r4/implementation-review.metadata.json",
+    "docs/investigations/r4/merge-verification.json",
+    "docs/investigations/r4/merge-verification.md",
+    "docs/investigations/r4/verification.md"
+  ],
+  "scope": "R5 local branch will rebase onto this exact R4 merge; no R5 push or merge."
+}
@@ -0,0 +1,340 @@
+{
+  "raw_files": [
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-ack.log",
+      "bytes": 607,
+      "sha256": "ef698b8f46c850928057a31bf4e92f64f9a0dcebb8753bab00e9dcef2b44ffb6"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-extended.log",
+      "bytes": 2764,
+      "sha256": "a52bb6644b82a1986c233deeb9fb7b6cd3f4975337aa11446a1b27c459355db9"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-matrix.log",
+      "bytes": 20974,
+      "sha256": "5348c2ae4a20238ae50f70bcaea3aa55169b3479f60eab522692bdabe3420ab0"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-pools-rotation.log",
+      "bytes": 2249,
+      "sha256": "1d47acbe4d759b0f413f90589ff51b1f844f1885885d45d11c72a6295f5a4653"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-pools.log",
+      "bytes": 358,
+      "sha256": "56dd5efc0c833070576c4c7e2cb2abca8a82380060596be58871067526557c32"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-production/cmd/bucket-replication.go",
+      "bytes": 137081,
+      "sha256": "1e4d27c9eb2bff51eb28460d167faa3279b541d43c77ce35ad010dcab58bf7c5"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-production/cmd/erasure-object.go",
+      "bytes": 84089,
+      "sha256": "1012ae265e2453db125c6f2d16f866c72760b58d61c18f79dff4a551c208e3ce"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-production/cmd/erasure-server-pool-consistency.go",
+      "bytes": 14240,
+      "sha256": "78e63ca1117ea2d3e3e93864a4365dfa9bb303b4707de5087bdc144d0502a0db"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-production/cmd/erasure-server-pool.go",
+      "bytes": 99706,
+      "sha256": "2bfe0899fe3e42840fa4f078887184e4d7d2332d780ce63c31c9495af7056406"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-production/cmd/object-handlers-common.go",
+      "bytes": 19143,
+      "sha256": "00bf8409d25f9cf6a098a90f9e0bd7d2b237be7adc12622f0b9a66146af0a828"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-production/cmd/object-handlers.go",
+      "bytes": 146644,
+      "sha256": "27d47a17e12088f41b35de51da875f28a89a7e821bc27d0f88e6064ec386c993"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-production/cmd/object-multipart-handlers.go",
+      "bytes": 48935,
+      "sha256": "c818ce72d9115ed4f9cbe51571e7737957010a3934a4d000000895e45100edc7"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-production/empty_test.go",
+      "bytes": 12,
+      "sha256": "9c78355c4da37df8f708f143fe19173dc146adcd99d1636594d265c5407755bf"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-production-overlay.json",
+      "bytes": 1508,
+      "sha256": "874d728abc9cb67c5db17ef4c3ce875d789ae4b5000dcbb593fe8dcd47094533"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-related-suite.log",
+      "bytes": 3521,
+      "sha256": "68b23b21c4de8b8252689f841376dec990257d929f0277d3087f467a246728e8"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline-resync.log",
+      "bytes": 116,
+      "sha256": "a620c0ecd112aceac9fd17b989b6283604a3866928ed51e9ed0b16079284fcbf"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline.log",
+      "bytes": 1629,
+      "sha256": "29d80ad52b0302d4eb4993db7a63c88bbc920923afa9775634d3c2fe000c066f"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/baseline_test.go",
+      "bytes": 18743,
+      "sha256": "ce609764fa53f7a86e77dc8f2c00c6d8b878c4c9b6f885fb2618bf8f932cad04"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/build-result.json",
+      "bytes": 729,
+      "sha256": "2df4873188d94c3745631b6e774e76a7646b3366fab7a3badf7ac1be136f7bd9"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/cache-reclaim.json",
+      "bytes": 2482128,
+      "sha256": "8dc7866b30bfd7fed339a3cd4a2dd40c0ec8f3b471cb004fc14f303a41642ad8"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/capacity-fixture/cmd/erasure-server-pool-consistency_test.go",
+      "bytes": 54157,
+      "sha256": "c3c1bf441e5f97fd2648c5fc9b89cb11679018e349daa4d0eef4ebbfada322db"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/capacity-fixture/cmd/post-policy_test.go",
+      "bytes": 33420,
+      "sha256": "697f8a08dceae481fd1aae7b5e7f3906b55b34fe9928688456eaa943eba79020"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/capacity-fixture/cmd/test-utils_test.go",
+      "bytes": 79596,
+      "sha256": "fb4847b10d3d59c7d62ee79a61d54e8c0bc93d6eb32cb520f5662bb7b52750f5"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/capacity-fixture-manifest.json",
+      "bytes": 426,
+      "sha256": "8940a56a6f46b7e9c236c3a8d39d927735954ae42601ca52c4a190339fb1f21f"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/capacity-fixture-overlay.json",
+      "bytes": 368,
+      "sha256": "3b8586973d426f78145aa25f0c3c9d48faf93678ffe9410fc9aa089cb6167af0"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/capacity-fixture.patch",
+      "bytes": 842,
+      "sha256": "3e3732c7fab2b95b9f2e80a6ee973a588600f84eeb2b74c2f15a09373228247f"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/capacity-post-manifest.json",
+      "bytes": 205,
+      "sha256": "34ae2c860a5cc1a9615d7b410eff781f5f01d54dba65f66edae0f724d3d232c7"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/capacity-post-overlay.json",
+      "bytes": 522,
+      "sha256": "8d0b7594481fa9028fbc4284e1e94cb853828925423d2a7b3cd6f5cbabb82e3c"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/capacity-post.patch",
+      "bytes": 358,
+      "sha256": "f4aa03d4a0a9f0bb220fa3b3b988a8dda1ad7d6764daaeb4e60eb4ee4e996674"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/discussion-baseline.log",
+      "bytes": 1029,
+      "sha256": "9581de36ec9a403d304c32192d17265b1e9c9414c60e9f2cb57321faebbe23dc"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/final-check-results.json",
+      "bytes": 939,
+      "sha256": "6652d2db1ac98d65232e37eda7738972a74f9569ac63b534f1af798ebf19f642"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/final-post-and-pools.log",
+      "bytes": 1280,
+      "sha256": "e7e5fec0761976470eafbf31bcefe4abc241525514f6c3b9a2baa035354144fa"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/fixed-resync-isolated.log",
+      "bytes": 116,
+      "sha256": "bed15b381379998bbe2a0aa1be19c2cfec1b0063886143dbe82918f9652c28ff"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/fixed-targeted-final.log",
+      "bytes": 25221,
+      "sha256": "32283f5d7eea5ce4974fefa0724a1c4de565bb0ef9a0f4fbcad68140bccc32b1"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/fixed-targeted-latest.log",
+      "bytes": 32772,
+      "sha256": "45f362258e21b631cb5ebcd15dec98bd2fa3186f509f18fe216d7cd0ebdb5a9c"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/fixed-targeted.log",
+      "bytes": 27709,
+      "sha256": "a30f7754f90cfade50ed80a066c5e2bd53faf225bd615cd07b9cf1350b2e3139"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/golangci-lint-serial",
+      "bytes": 103,
+      "sha256": "b2a00c2702468165a7851ee3a6addbef9e581833a33492d44ac66d531cfc4fff"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/implementation-files.json",
+      "bytes": 936,
+      "sha256": "7bd1279e1c99da9da4562cda6e0265d36d53a9bb546f10d42c4174c1a34b5c70"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/implementation-v1.patch",
+      "bytes": 48399,
+      "sha256": "8f6f76ee874c43b0827fde272e8a947f118efb1c1af92bf4a02ef88f93554c1b"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/make-build.log",
+      "bytes": 55,
+      "sha256": "6ba9b545236be964861749c72e7609edf12b8f470df30d1ede8fd62f497e629b"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/make-verifiers-final.log",
+      "bytes": 217,
+      "sha256": "d973482061716daa245e7d7162765dec0e6ecd5fee41249d2702a2d8bfce1c32"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/make-verifiers-serial.log",
+      "bytes": 410,
+      "sha256": "e42a5bb55f5c1ebfcf02cebebf6d82cf1ec5a2d74590cdf838deba16dd80bfdf"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/make-verifiers-success.log",
+      "bytes": 162,
+      "sha256": "b4982b6a7302e733c7bec4a5fb36b8ee8865fe95f1595e7079ce7f8455406210"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/make-verifiers.log",
+      "bytes": 285,
+      "sha256": "42f4b147ef4aac45ba91457e7932db30f9b57f285466ee3f10bbaa9a911e5bc7"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/matrix-overlay.json",
+      "bytes": 153,
+      "sha256": "a0fb5eb71ebb2bdb3374813752de5867848454794bcbf302ba0f6d7d4f6c0519"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/matrix_test.go",
+      "bytes": 22996,
+      "sha256": "c9cf527c63800fa045bdf0b8e95d740b81a3d5be3a08c74811fa5c06bed56d4f"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/opus-implementation-request.json",
+      "bytes": 909,
+      "sha256": "9fab15ce1cfb5bad102b1880968e4731a7b5cb02d6d01e6cb2caf8bc9029a150"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/opus-implementation.jsonl",
+      "bytes": 1184150,
+      "sha256": "fef155a7382c8f66f69b7afd5fd94559edcc6f72fc13aeb7ef01319c22c09861"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/opus-implementation.stderr.log",
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/opus-v1-request.json",
+      "bytes": 216,
+      "sha256": "175e013154c241805e00368f7841d41faf48ee847ff5251aad96ae57831e244a"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/opus-v1.jsonl",
+      "bytes": 1017882,
+      "sha256": "63c00d8362f236a18293e1a637eff3b7c7e38b0bbd11805f75d91e8774efcdb2"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/opus-v1.stderr.log",
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/opus-v2-request.json",
+      "bytes": 216,
+      "sha256": "ed710eff03d3ebabab277c9e453048097a8649582df4b01f99d0ee0ad3a7c831"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/opus-v2.jsonl",
+      "bytes": 414265,
+      "sha256": "e888fbf38ba7fd49891e0757c18006875d02a6bbb325906a31fc8d98e54d0e39"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/opus-v2.stderr.log",
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/overlay.json",
+      "bytes": 142,
+      "sha256": "d51934eb99e2b19d149478e090ec327ed2753a5ad2a026c8745b8e2554962a00"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/related-filter.txt",
+      "bytes": 5771,
+      "sha256": "f022bc24ae0fe391ae51a5095db1d2e415a994934327c7508e6c65edc313cc78"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/related-names.txt",
+      "bytes": 5767,
+      "sha256": "369ed4b6742d15e8ab4d790615842304a7178fbdc598e231e9205fc096c0785a"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/related-suite-capacity-final.log",
+      "bytes": 137077,
+      "sha256": "322d4854ba909bd99d5c7740abeeac05eb76cb2d39d2c7541642335ae6a1ffe9"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/related-suite-capacity.log",
+      "bytes": 3362,
+      "sha256": "1e4f1bc6be2b4339a0d9b7a2e951774fc24ec5521be9fcf53b2ce02031f5cdbe"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/related-suite-rest.log",
+      "bytes": 172665,
+      "sha256": "846d10084299a77253153c0eed8546e275c789a0289a4198052773e49a73423f"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/related-suite.log",
+      "bytes": 3521,
+      "sha256": "38e3e8e4b7ae815fce40931009a0d4755601a4f3f7f9f44a569edff024c9239b"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/sender_test.go",
+      "bytes": 5140,
+      "sha256": "a1a58fd6968b41cf6c565d9f63a1d0fa1c907f008f70acfd13c7a6c525376357"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/silo-version.log",
+      "bytes": 317,
+      "sha256": "8ce9c5d15082a78e696aa79f8ec007f72ce969ce6ebd7dab2f7db69b20b51f8b"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/targeted-race-final.log",
+      "bytes": 39753,
+      "sha256": "127cfb73f415bad43e2fd79c05150ab765322dcadb29e687b752b6174d4ad850"
+    },
+    {
+      "path": "/Users/vonng/tmp/silo-r5-20260915-77ad/verifiers-result.json",
+      "bytes": 417,
+      "sha256": "6faea89c420685ccae0642be88ddf86938bb25e24f066fd9e57138d16c9e9856"
+    }
+  ],
+  "binary": {
+    "path": "/Users/vonng/.codex/worktrees/77ad/silo/silo",
+    "bytes": 93070802,
+    "sha256": "dd789126966d4a42bc0a9bcd8b8eab9714e3eadc7a524505a6224ea6d76c750f"
+  },
+  "scope": "Local development build and exact raw verification/review records; no publication or production acceptance."
+}
@@ -0,0 +1,20 @@
+{
+  "research_base": "9ebe81c1b3611f9cc73e676b5b741c2be62c467a",
+  "tested_dependency": "dbcf8dec589deb5d91e17d295cb70997635f5b55",
+  "reviewed_patch_sha256": "8f6f76ee874c43b0827fde272e8a947f118efb1c1af92bf4a02ef88f93554c1b",
+  "plan_version": "v2",
+  "plan_sha256": "5a782acf3f285b23d1ae43a73481c4eb772a9a6d917fc5a550ecfc7cbf7446ca",
+  "files": {
+    "cmd/bucket-replication.go": "cbab22ffe316fabc076e7f4a1fa5b1417d07b265ae9dc1b27454689355926d35",
+    "cmd/erasure-object.go": "4bc848685ea714d88cabbd5d1b8585fbcc06f7b19c775e1a811030e783d0e1a4",
+    "cmd/erasure-server-pool-consistency.go": "d2736ef6bffbb5c5758eba8df38f8d4ecb888a838ab0de8ad3cf015c051f8ad7",
+    "cmd/erasure-server-pool.go": "87ad0b25dfa3081d0e63d0073b788614a9c88e2498a2ce0956b93f8a0a03ef53",
+    "cmd/object-handlers-common.go": "101bd7d7447072d13fed50983b69b562e4725632645e623d7fdd490f388ecdec",
+    "cmd/object-handlers.go": "61897a260f3f5f660f41edcb50956c60e914ef98f9a987da824f16d78171fde2",
+    "cmd/object-multipart-handlers.go": "d9622c69c540ab32dd23916e3f534b6886473a98370c9dd17673e69a423b2a7e",
+    "cmd/replication-tagging-order_test.go": "c8260b4ccf82fa615e1e24b35a07f2d1aacbcf776e5c6f9dadffea4a09ad6ea8",
+    "cmd/replication-tagging-sender_test.go": "3770a1a48a6efe58fe8127e1e4fdf6bd7cf171e17db20f15222ea2f7b85db1af"
+  },
+  "production_unchanged_after_review": true,
+  "delivery_dependency": "af2b1794d38d9e70e1d2c3ee692426e4b6cab4bd"
+}
@@ -0,0 +1,17 @@
+{
+  "base_commit": "dbcf8dec589deb5d91e17d295cb70997635f5b55",
+  "plan_version": "v2",
+  "plan_sha256": "5a782acf3f285b23d1ae43a73481c4eb772a9a6d917fc5a550ecfc7cbf7446ca",
+  "patch_sha256": "8f6f76ee874c43b0827fde272e8a947f118efb1c1af92bf4a02ef88f93554c1b",
+  "files": {
+    "cmd/bucket-replication.go": "cbab22ffe316fabc076e7f4a1fa5b1417d07b265ae9dc1b27454689355926d35",
+    "cmd/erasure-object.go": "4bc848685ea714d88cabbd5d1b8585fbcc06f7b19c775e1a811030e783d0e1a4",
+    "cmd/erasure-server-pool-consistency.go": "d2736ef6bffbb5c5758eba8df38f8d4ecb888a838ab0de8ad3cf015c051f8ad7",
+    "cmd/erasure-server-pool.go": "87ad0b25dfa3081d0e63d0073b788614a9c88e2498a2ce0956b93f8a0a03ef53",
+    "cmd/object-handlers-common.go": "101bd7d7447072d13fed50983b69b562e4725632645e623d7fdd490f388ecdec",
+    "cmd/object-handlers.go": "61897a260f3f5f660f41edcb50956c60e914ef98f9a987da824f16d78171fde2",
+    "cmd/object-multipart-handlers.go": "d9622c69c540ab32dd23916e3f534b6886473a98370c9dd17673e69a423b2a7e",
+    "cmd/replication-tagging-order_test.go": "64d6dfe3436970caeafcb914157bdedac5982a2105fe72c1753a8d68cf7ed6ef",
+    "cmd/replication-tagging-sender_test.go": "3770a1a48a6efe58fe8127e1e4fdf6bd7cf171e17db20f15222ea2f7b85db1af"
+  }
+}
@@ -0,0 +1,26 @@
+# R5 implementation review disposition
+
+Real reviewer: `claude-opus-5`, explicit `--effort max`, session `599b4759-add2-4a41-b5b2-865af7a2c096`.
+Verdict: **GO_WITH_NONBLOCKING_NOTES; 0 blockers**. Raw review is preserved verbatim in `opus-implementation-review.md`; model usage, original plan/patch hashes and raw log location are in `opus-implementation-metadata.json`.
+
+The accepted v2 plan remains immutable. The following implementation notes supplement it; they do not retroactively change the hash on which plan consensus was reached.
+
+## Nonblocking notes
+
+- **N1 accepted:** a scheduled metadata COPY can rewrite object data when the receiver applies bucket-default/automatic KMS encryption. Its cost can therefore exceed metadata I/O. The existing completed-object/scanner and incoming-replica scheduling gates still prevent a feedback loop. No new transfer optimization or HEAD protocol is introduced.
+- **N2 accepted:** a malformed recorded source tag timestamp fails sender construction and remains a retry failure until an explicit correct tag mutation/repair supplies a valid revision. A missing revision is different from a present invalid/empty value. No historical time is fabricated, and no automatic production rewrite is performed.
+- **N3 retained scope:** existing marker/trust/REPLICA/version predicates are preserved. Production sender requests satisfy the relevant predicates; R5 does not broaden replication trust.
+- **N4 accepted compatibility change:** a trusted metadata COPY without a source tag revision preserves stored tags, including the metadata-REPLACE shape. This is the deliberate missing-revision rule in plan C, and is tested under UUID/null versions and unqualified COPY.
+- **N5 accepted:** ordinary COPY records its chosen tag state, including an empty REPLACE and unchanged tags during key rotation, as a fresh local event. This is consistent with the accepted last-writer-wins scheme.
+- **N6 no change:** all production writers use the lowercase reserved timestamp key. Case-insensitive sender lookup is compatible with those writers and existing lock timestamp handling.
+
+## Coverage notes
+
+- **L1:** the review was supplied a passing run with **13**, not 12, top-level R5 tests. Its verdict explicitly did not claim execution of the wider tests. The wider selection reproduced the same `TestReplicationResync` order-dependent initialization panic on the unmodified production baseline; that test passes in isolation on both baseline and R5. Host-capacity and actual ENOSPC failures are retained, not reported as passes. Final related, race and static/build results are recorded separately in `verification.md`. An unfiltered full `cmd` package run remains an integration check before any later merge; this task delivers a local patch and does not claim that full-package or multi-site production gate passed.
+- **L2 addressed:** after every incoming multi-pool replay, the R5 test now rereads the addressed version through normal pool routing and checks its empty value and deletion revision. The per-pool checks still inspect every retained copy. This prevents a vacuous pass if all copies disappear. The test deliberately allows existing duplicate suppression to retain both identical copies; existing pool cleanup/retry tests separately exercise retirement.
+- **L3 accepted boundary:** the combined KMS cases exercise destination encryption and plaintext readback; source fixtures are populated through storage APIs. They do not establish encrypted-source-to-encrypted-destination replication across two running sites. SSE-C key rotation has its own signed HTTP and decrypted GET test.
+- **L4 confirmed:** both the actual SDK default metadata directive and peer metadata-REPLACE shapes are exercised.
+
+## Changes after review
+
+Production code is unchanged from reviewed patch SHA256 `8f6f76ee874c43b0827fde272e8a947f118efb1c1af92bf4a02ef88f93554c1b`. Test-only follow-up adds the L2 normal-routing read and applies the repository's gofumpt formatting. `implementation-manifest.json` records the exact reviewed files; the final verification manifest records the final files, so the two versions are distinguishable.
@@ -0,0 +1,46 @@
+{
+  "model": "claude-opus-5",
+  "effort": "max",
+  "baseline": "dbcf8dec589deb5d91e17d295cb70997635f5b55",
+  "plan_version": "v2",
+  "plan_sha256": "5a782acf3f285b23d1ae43a73481c4eb772a9a6d917fc5a550ecfc7cbf7446ca",
+  "patch_sha256": "8f6f76ee874c43b0827fde272e8a947f118efb1c1af92bf4a02ef88f93554c1b",
+  "actual_assistant_models": [
+    "claude-opus-5"
+  ],
+  "session_id": "599b4759-add2-4a41-b5b2-865af7a2c096",
+  "is_error": false,
+  "modelUsage": {
+    "claude-haiku-4-5-20251001": {
+      "inputTokens": 2125,
+      "outputTokens": 15,
+      "cacheReadInputTokens": 0,
+      "cacheCreationInputTokens": 0,
+      "webSearchRequests": 0,
+      "costUSD": 0.0022,
+      "contextWindow": 200000,
+      "maxOutputTokens": 32000,
+      "thinkingTokens": 0,
+      "canonicalModel": "claude-haiku-4-5",
+      "provider": "firstParty",
+      "costBasis": "list"
+    },
+    "claude-opus-5": {
+      "inputTokens": 106,
+      "outputTokens": 64414,
+      "cacheReadInputTokens": 7275193,
+      "cacheCreationInputTokens": 236959,
+      "webSearchRequests": 0,
+      "costUSD": 7.618066499999999,
+      "contextWindow": 1000000,
+      "maxOutputTokens": 64000,
+      "thinkingTokens": 45128,
+      "canonicalModel": "claude-opus-5",
+      "provider": "firstParty",
+      "costBasis": "list"
+    }
+  },
+  "result": "GO_WITH_NONBLOCKING_NOTES",
+  "blocking_items": 0,
+  "raw_output": "/Users/vonng/tmp/silo-r5-20260915-77ad/opus-implementation.jsonl"
+}
@@ -0,0 +1,27 @@
+Review the actual R5 implementation independently for correctness and regressions, using Claude Opus 5 at max effort. This is a read-only final code review after an already recorded two-round plan consensus. Do not edit files. Do not simulate tests or claim you executed them. Read the relevant source and evidence yourself; focus on material blockers and minimal compatible fixes.
+
+Working tree: /Users/vonng/.codex/worktrees/77ad/silo
+Base dependency commit: dbcf8dec589deb5d91e17d295cb70997635f5b55 (R4 KMS timestamp field, one production addition)
+R5 plan v2 SHA256: 5a782acf3f285b23d1ae43a73481c4eb772a9a6d917fc5a550ecfc7cbf7446ca
+R5 implementation patch SHA256: 8f6f76ee874c43b0827fde272e8a947f118efb1c1af92bf4a02ef88f93554c1b
+Manifest: /Users/vonng/.codex/worktrees/77ad/silo/docs/investigations/r5/implementation-manifest.json
+Frozen review patch (7 production files + 2 new tests): /Users/vonng/tmp/silo-r5-20260915-77ad/implementation-v1.patch
+Plan: /Users/vonng/.codex/worktrees/77ad/silo/docs/investigations/r5/plan-v2.md
+Prior actual review: /Users/vonng/.codex/worktrees/77ad/silo/docs/investigations/r5/opus-v2-review.md
+Consensus and disagreements: /Users/vonng/.codex/worktrees/77ad/silo/docs/investigations/r5/consensus.md, /Users/vonng/.codex/worktrees/77ad/silo/docs/investigations/r5/opus-v1-response.md
+Baseline reproduction: /Users/vonng/.codex/worktrees/77ad/silo/docs/investigations/r5/reproduction.md
+Latest new regression run: /Users/vonng/tmp/silo-r5-20260915-77ad/fixed-targeted-latest.log (PASS, 9.161s; signed HTTP and actual storage on single/16 disks, null/UUID, COPY default and REPLACE, PUT/multipart, KMS plaintext GET, SSE-C rotation, multi-pool, retry and stale source ACK; test names and details in source.)
+Additional related suite and race/static validation are ongoing and are not yet accepted. An expanded suite hit existing TestReplicationResync initialization panic before R5 tests; baseline isolation is ongoing. Do not treat that as a proven R5 regression or a passing test.
+
+Research and implementation points to scrutinize:
+1. Empty tag values are ordered states only with recorded timestamp; no fabricated tombstone for empty legacy object. Nonempty legacy sender falls back to ModTime. Malformed stored timestamp fails PUT and metadata COPY sender construction.
+2. Local PUT/DELETE tagging timestamps are unconditional, advance under existing storage locks; pooled mutation computes a single revision > every copy; do not mutate caller map. Replicas keep source ordering and equal timestamp stored-wins.
+3. Actual sender getCopyObjMetadata + minio Core.CopyObject sends tagging REPLACE with no metadata directive; peers may also send metadata REPLACE. Capture stored timestamp before reconstruction, accept incoming empty value, prevent stale SSE-C encMetadata snapshot overwrite, keep existing storage rechecks.
+4. PUT/multipart init persist parsed trusted timestamp. Matching ETag/version no-op is relaxed only for trusted newer tag revision, retaining explicit client preconditions and SSE-C behavior. Multipart completion rechecks revision under lock.
+5. Equal visible tag values can hide a newer deletion/re-addition revision, so scheduled metadata/heal work with recorded timestamp sends metadata. Preserve existing Completed/scanner and incoming no-reschedule gates.
+6. Replication status ACK no longer writes old queued ri.UserTags over the current tags. Preserve current value/timestamp under metadata lock including multi-pool.
+7. Scope explicitly excludes tag-filter target eligibility changes, historical tombstone recovery, arbitrary independent unversioned content replacements, clock skew consensus, and production multi-site acceptance. R4 owns object-api-options.go; it is not in this R5 diff.
+
+There was an earlier KMS test-only fixture error: it assigned a single-PUT ETag to a multipart-layout retransmission; corrected by seeding a real multipart source and using its actual ETag/layout (full latest run passes plaintext read). Inspect the fixture rather than inferring production encryption correctness solely from prior failed test output.
+
+Return a clear GO / GO_WITH_NONBLOCKING_NOTES / REQUEST_CHANGES verdict; blocking count; concrete source locations with cause, trigger and effect for any blockers; tests/coverage limitations if material. State which baseline, plan hash and patch hash you reviewed (you may quote supplied hash, but cannot independently compute with Read/Grep/Glob). Do not demand unrelated broad redesign. Distinguish actual source defect from nonblocking improvement or scope limitation.
@@ -0,0 +1,58 @@
+Write is disabled in this session, so I'll deliver the review directly rather than to the plan file.
+
+# R5 implementation review — tag deletion and ordered replication
+
+## Verdict: **GO_WITH_NONBLOCKING_NOTES** — blocking count: **0**
+
+Read-only review. No files edited, no tests run, no results simulated. Every pass I cite is quoted from the supplied log.
+
+## What I reviewed
+
+| Item | Value |
+|---|---|
+| Working tree | `/Users/vonng/.codex/worktrees/77ad/silo`, branch `codex/r5-tag-deletion-ordering` |
+| Baseline dependency | `dbcf8dec589deb5d91e17d295cb70997635f5b55` (R4 SSE-KMS field) |
+| Plan | `plan-v2.md`, SHA256 `5a782acf…7fc7446ca` *(quoted)* |
+| Patch | `implementation-v1.patch`, SHA256 `8f6f76ee…f88f93554c1b` *(quoted)* |
+
+**Hash caveat:** with Read/Grep/Glob I **cannot compute** either SHA256 — both are quoted from the manifest/task. What I did verify by reading is that every hunk in the frozen patch is present verbatim in the working tree across all seven production files. That is source identity by inspection, not by digest. I also confirmed R5 does not touch `cmd/object-api-options.go`; the R4 branch carrying `ReplicationSourceTaggingTimestamp` (`object-api-options.go:449-460`) is unmodified.
+
+## Per-claim findings
+
+**1. Empty values are ordered states; no fabricated legacy tombstone.** Confirmed. `replicationTaggingTimestamp` (`bucket-replication.go:786-794`) returns the recorded stamp even with empty tags, falls back to `ModTime` only for non-empty tags, zero otherwise. Used by both `putReplicationOpts` (`:861-870`) and the metadata sender (`:1702-1707`). The SDK omits the header for a zero time (`minio-go@…60bd07042d49/api-put-object.go:236-238`, `api-compose-object.go:286-288`), so "no revision" really travels as absence. Malformed stamps fail both constructions.
+
+**2. Local revisions unconditional and monotonic.** Confirmed. Both handlers mint one `UTCNow()` outside the `dsc.ReplicateAny()` branch (`object-handlers.go:3773-3778`, `:3876-3881`); `getOpts` leaves `opts.UserDefined` nil (`object-api-options.go:110`,`:39`), so the unconditional map replacement drops nothing. `er.PutObjectTags` applies the guard under the existing NS lock (`erasure-object.go:2273-2282`, `:2330-2334`); an absent stamp yields `""` and preserves legacy direct-storage semantics. `z.PutObjectTags` folds one candidate strictly beyond every copy and **clones** first (`erasure-server-pool.go:3054-3062`) — `opts` is a value parameter and `er.PutObjectTags` never writes `opts.UserDefined`, so no caller map is mutated. No replica path reaches `PutObjectTags` (the only two production callers are the tagging handlers), so replicas keep strict source ordering via `reconcileStoredObjectTags`, stored-wins on ties (`erasure-server-pool-consistency.go:238-242`).
+
+**3. COPY receiver.** Confirmed. Stored pair captured before reconstruction (`object-handlers.go:1800`); `srcInfo.UserTags` is never reassigned between the source read and the decision, so it genuinely is stored state. The decision block (`:1818-1837`) accepts an incoming empty value with a stamp and rechecks the captured state; all existing in-lock rechecks still run (`erasure-object.go:136-138`, `:1312-1315`; `erasure-multipart.go:1161-1190`; `erasure-server-pool.go:1443-1450`). The `encMetadata` fix (`:1840`) is safe and correctly placed — `encMetadata` receives reserved keys only on the SSE-C rotation path (`:1655-1659`), and the delete lands after `rotateKey`/`newEncryptReader` and before the merge at `:1910`.
+
+**4. PUT/multipart persistence and the duplicate exception.** Confirmed. `putOptsFromHeaders` aliases `opts.UserDefined = metadata` in both branches (`object-api-options.go:451`,`:464`), so post-build writes reach storage (`object-handlers.go:2323-2325`; `object-multipart-handlers.go:315-318`, correctly *after* `maps.Copy(metadata, encMetadata)` at `:300`). The relaxation (`object-handlers-common.go:243-246`) sits below the explicit `If-Match`/`If-None-Match` checks, is gated on `isReplicaTrusted` + `olderThan` (zero source never wins, `bucket-object-lock.go:370-376`), and leaves the SSE-C exemption intact. It cannot loop: once the write lands the stamps are equal and the next attempt 412s. `completeMultipartOpts` sets neither `PreserveETag` nor a tagging timestamp (`object-api-options.go:501-550`), so completion needs no new exception and reconciles under the lock (`object-multipart-handlers.go:1201`).
+
+**5. Equal values can hide a newer revision.** Confirmed and correctly scoped. The gate (`bucket-replication.go:1013-1018`) sits after the null-version resync exclusion and after **every** branch that can return `replicateAll`; from there only `replicateMetadata`/`replicateNone` are reachable, so it can never downgrade a needed full transfer. It is reached only from `replicationActionForTarget` → `replicateAll` (`:1608`), not from the object-replication fast path (`:1328-1343`). The Completed gate (`:3775`) and failures-only requeue (`:1316`) bound the work, and an incoming replica COPY schedules no outgoing event. Existing fixtures carry no tagging stamp (`bucket-replication_test.go:716-739`), so they are unaffected.
+
+**6. ACK no longer overwrites current tags.** Confirmed removed (`bucket-replication.go:1276-1286`). Preservation holds on both write-backs: `er.PutObjectMetadata` copies from `ObjectInfo.UserDefined`, which `cleanMetadata` strips of `x-amz-tagging` (`object-api-utils.go:403-407`; `erasure-object.go:2254-2260`); `updatePoolMetadata` falls back to merged `UserTags` and rewrites the merged newest stamp (`erasure-server-pool-consistency.go:194-214`). Both under the object lock (`erasure-object.go:2196-2205`; `erasure-server-pool.go:3020-3029`). The sender also re-reads current state first (`bucket-replication.go:1527-1550`).
+
+**7. Scope.** Respected — no tag-filter eligibility change, no historical tombstone invention, no clock-skew consensus, no `object-api-options.go` change.
+
+**Trust boundary re-checked:** the reserved key cannot be injected from the wire — `containsReservedMetadata` rejects the whole `X-Minio-Internal-` class outside the SSE allowlist (`generic-handlers.go:75-85`), and `extractMetadataFromMimeWithReplication` maps only `replicationToInternalHeaders` (`handler-utils.go:258-298`).
+
+**KMS fixture inspected directly**, not inferred from prior output: the multipart case now seeds a real multipart source and reuses its actual ETag/part layout (`replication-tagging-order_test.go:472-489`). The earlier single-PUT-ETag mismatch is gone. See L3 for what it still does not cover.
+
+## Non-blocking notes (no change required)
+
+- **N1 — on encrypted destinations the forced metadata COPY is not metadata-only.** The gate at `bucket-replication.go:1013-1018` yields a replica COPY; with bucket-default/auto KMS the destination applies SSE before `copyDstOpts` (`object-handlers.go:1428-1433`) and then clears `srcInfo.metadataOnly` (`:1669-1677`) — so it **rewrites object data**. Bounded to one COPY per object entering heal and one per object per explicit resync (not a loop), but the plan's "extra metadata I/O" understates this case. Worth a sentence in the cost note.
+- **N2 — fail-closed on a malformed stored revision is terminal for that object** (`:786-794` → `:1702-1707`/`:867-870`, requeued by MRF at `:1316-1322`). No production writer can produce such a value, so this is a defensive tail. Note the asymmetry: storage self-heals the same corruption (invalid *stored* ⇒ incoming wins, `erasure-server-pool-consistency.go:238-242`) while the sender refuses to proceed. The minimal hardening, if ever wanted, is to treat a present-but-**empty** value as absent — I traced no reachable path producing one, and the current behavior is what plan and consensus chose, so I am not asking for it.
+- **N3 — trusted-marker vs REPLICA asymmetry (pre-existing).** `object-handlers.go:2323` / `object-multipart-handlers.go:316` persist on `opts.ReplicationRequest`, while the in-lock recheck needs `isReplicaTrusted` **and** a version ID (`:2442`). Production sets both; the new precondition exception uses the stricter predicate. Accepted in plan §D.
+- **N4 — a trusted metadata COPY with no source revision now ignores the request's tag value** (`object-handlers.go:1826-1833`). For a peer sending `x-amz-metadata-directive: REPLACE` without a revision, the value used to land (`X-Amz-Tagging` is in `supportedHeaders`, `handler-utils.go:271-283`). No MinIO sender produces that shape, and the R4 case `object-copy-replication-tagging_test.go:89` already expects stored-wins there, reaching it via the storage reconcile. Deliberate per plan §C.
+- **N5 — ordinary COPY always writes an explicit tag value plus a fresh revision** (`:1834-1837`). (a) `x-amz-tagging-directive: REPLACE` with no tags now genuinely clears the destination, where the default-metadata path used to carry source tags forward — an S3 conformance improvement, covered by `TestAPILocalTaggingAlwaysAdvancesRevision`. (b) An in-place key-rotation COPY advances the revision without changing any value, re-asserting current tags against an older in-flight remote deletion. Both follow from last-writer-wins as specified.
+- **N6 — cosmetic.** The key is read case-insensitively at `bucket-replication.go:787`/`:1016`, exactly elsewhere. `TaggingTimestamp` is lowercase (`:74`) and storage writes only lowercase, so they agree; the same mix already exists for lock timestamps in that file (`:896` vs `:1708`).
+
+## Tests and coverage limitations (material)
+
+- **L1 — the only established green result is the 12 R5 tests** (`fixed-targeted-latest.log`, `ok … 9.161s`): signed HTTP through real single-disk and 16-disk storage, null/UUID, COPY default and REPLACE, PUT/multipart, KMS, SSE-C rotation, multi-pool, sender retry and stale ACK. The wider `cmd` package, `-race`, `gofmt` and `git diff --check` are ongoing, and the `TestReplicationResync` panic is unattributed. I treat that as an **open verification item**, not a regression and not a pass. My static read found no existing test whose expectations R5 flips — I checked the `getReplicationAction` fixtures, the R4 KMS COPY table including its `missing-timestamp` case (R5 satisfies it via the handler instead of the storage reconcile), and confirmed no pre-existing test calls `PutObjectTags` with a supplied revision.
+- **L2 — multi-pool convergence after an *incoming* replica write is asserted weakly.** `replication-tagging-order_test.go:688-698` skips any pool whose version is absent and only asserts a retained copy is correct; it pins neither which pool is retained nor that retirement ran. The case that matters for §A — one revision strictly greater than every copy, in the response *and* every stored copy — is pinned by `TestLocalTaggingCommitCannotRegressRevision`.
+- **L3 — the KMS variant's source objects are plaintext.** Seeds use `obj.PutObject` (`:468`, `:477-488`), bypassing handler encryption, so encryption enters only via the incoming request and the destination bucket default. Real coverage of the R4 field on the receive side, but not encrypted-source-to-encrypted-destination end to end. The trailing plaintext GET (`:520-523`) does establish the final object is readable.
+- **L4 — wire shape is well pinned.** `TestTaggingProductionCopyWireShape` asserts the real SDK request (`metadata-directive=""`, `tagging-directive=REPLACE`) against a live peer, and `r5Receive`'s `"copy"` operation covers peer metadata-REPLACE independently. Both required shapes are present.
+
+## Recommendation
+
+The production diff is merge-eligible as written; I found no actual source defect. The single gating action before merge is closing **L1** — a clean full-package run (plus `-race`, `gofmt`, `git diff --check`) with the `TestReplicationResync` panic isolated against the unpatched baseline. N1 and N2 deserve a sentence each in the plan's cost/limitations section; N3–N6 are already covered by plan §C/§D and need no action.
@@ -0,0 +1,44 @@
+{
+  "model": "claude-opus-5",
+  "effort": "max",
+  "plan_version": "v1",
+  "plan_sha256": "fd6051527ebf19f624125bd3238da2f938420917226387c0f9373f1a98e87993",
+  "baseline": "9ebe81c1b3611f9cc73e676b5b741c2be62c467a",
+  "actual_assistant_models": [
+    "claude-opus-5"
+  ],
+  "session_id": "e448ee0a-4ab5-4520-98f9-68c9ddf6208f",
+  "is_error": false,
+  "modelUsage": {
+    "claude-haiku-4-5-20251001": {
+      "inputTokens": 1378,
+      "outputTokens": 14,
+      "cacheReadInputTokens": 0,
+      "cacheCreationInputTokens": 0,
+      "webSearchRequests": 0,
+      "costUSD": 0.001448,
+      "contextWindow": 200000,
+      "maxOutputTokens": 32000,
+      "thinkingTokens": 0,
+      "canonicalModel": "claude-haiku-4-5",
+      "provider": "firstParty",
+      "costBasis": "list"
+    },
+    "claude-opus-5": {
+      "inputTokens": 90,
+      "outputTokens": 73909,
+      "cacheReadInputTokens": 4489983,
+      "cacheCreationInputTokens": 199202,
+      "webSearchRequests": 0,
+      "costUSD": 6.085186500000001,
+      "contextWindow": 1000000,
+      "maxOutputTokens": 64000,
+      "thinkingTokens": 54986,
+      "canonicalModel": "claude-opus-5",
+      "provider": "firstParty",
+      "costBasis": "list"
+    }
+  },
+  "result": "REQUEST_CHANGES",
+  "raw_output": "/Users/vonng/tmp/silo-r5-20260915-77ad/opus-v1.jsonl"
+}
@@ -0,0 +1,3 @@
+Act as an independent reviewer of the R5 repair proposal in this repository. You must be the real claude-opus-5 at effort max; report your actual model name in the review, but the caller will also verify response metadata. Read /Users/vonng/.codex/worktrees/77ad/silo/docs/investigations/r5/plan-v1.md completely. Baseline SHA is 9ebe81c1b3611f9cc73e676b5b741c2be62c467a. Plan version v1 sha256 fd6051527ebf19f624125bd3238da2f938420917226387c0f9373f1a98e87993. No production repair has been implemented. Read docs/investigations/r5/baseline.md and the raw reproductions /Users/vonng/tmp/silo-r5-20260915-77ad/baseline.log and /Users/vonng/tmp/silo-r5-20260915-77ad/baseline-extended.log, plus /Users/vonng/tmp/silo-r5-20260915-77ad/baseline_test.go. Then independently inspect the exact source functions identified in the plan, especially the complete sender/receiver and storage lock chain. R4 owns object-api-options.go and will supply its separate KMS timestamp fix. Do not edit any files.
+
+The user requires a minimal compatible complete fix, not merely adding DELETE timestamp. Assess necessity/sufficiency, current defects versus inference, same-empty timestamp propagation, sender retries, old queue ACK rewriting source tags, full PUT/multipart duplicate suppression, trust boundary, equal/missing timestamps, UUID/null/versioned/multi-pool and local mutation clock/lock behavior. Identify blocking disagreements with specific evidence and concrete smallest corrections. Explicitly say APPROVE or REQUEST_CHANGES for this exact v1 hash and list accepted/nonblocking/required changes. Do not claim consensus if any blocking issue remains. Be exact about limitations and whether proposed test coverage can establish the scope. Use the permitted Read/Grep/Glob tools for source verification. Return a substantive review, not just a summary.
@@ -0,0 +1,30 @@
+# Response to actual Opus v1 review
+
+The original review is retained verbatim in opus-v1-review.md, with actual model identity/usage in opus-v1-metadata.json and the full stream in the raw evidence directory. Result was REQUEST_CHANGES, five blockers. No implementation was started and no consensus is implied by the response below.
+
+## Blocking items
+
+| Item | Disposition for v2 |
+|---|---|
+| R1 empty/no-revision ModTime fallback | Accepted. Never synthesize a revision for empty tags without one. Keep only existing nonempty ModTime fallback. Add no-revision wire regression. |
+| R2 force metadata only for empty values | Disagree with the proposed restriction; accept the I/O cost warning. Same nonempty values can carry different revisions: X@T1, delete@T2, re-add X@T3. Skipping T3 lets delayed delete T2 incorrectly win. A recorded revision requires delivery for either value. v2 explicitly accepts extra COPY per scheduled/resync invocation. queueReplicationHeal already skips Completed unless resync requested; replicateObject only requeues Failed. Thus the predicate is permanently conservative, but it does not create perpetual background work. Avoiding a new HEAD protocol is the smaller implementation. Re-review required. |
+| R3 actual metadata COPY request shape | Accepted after inspecting the pinned minio-go Core.CopyObject/copyObjectDo. getCopyObjMetadata supplies only tagging REPLACE; the SDK adds no metadata directive. Update provenance and test both actual SDK shape and peers using metadata REPLACE. |
+| R4 local revision inversion | Accepted and strengthened for uniform multi-pool persistence. er.PutObjectTags advances a valid supplied revision beyond stored time under lock. z.PutObjectTags computes one value beyond every addressed copy before writing, so the response, ordinary source read and all copies agree. Per-pool-only guards can produce different times; mergedPoolObjectInfo is not every ordinary read path, so relying on later merge is insufficient for a precise source revision. Direct calls without valid supplied revisions keep old semantics. |
+| R5 duplicate suppression wording | Accepted. Explicitly use strictly-newer-than-stored, with existing olderThan semantics. Preserve client preconditions; only trusted REPLICA source timestamps can relax version/ETag duplicate suppression. Document possible data re-upload cost. |
+
+## Nonblocking items
+
+- Equal times: document stored-wins consistency across COPY and storage, including null/unqualified requests.
+- Invalid COPY sender timestamp: fail the metadata send with Failed, as PUT option construction does; no silent fallback.
+- Tag trust versus replica trust: preserve existing predicates, document production supplies both. No permission relaxation.
+- KMS nuance: agree PUT/multipart depend on R4, but disagree that metadata COPY never depends on R4. Destination bucket defaults and globalAutoEncryption inject KMS before copyDstOpts at object-handlers.go 1425–1435. R4 independently reproduced all three explicit/default/auto entrypoints. Do not adopt the inaccurate broader exclusion. Combined tests required.
+- Ordinary whole-object replacement/no-version clocks: document unchanged semantics. This plan addresses local tagging mutation and selected per-hop replicated version updates; it does not create a new conflict model for independent unversioned content overwrites.
+- Tag-filtered target eligibility: document the pre-existing scope limitation; no selection/rule protocol redesign in R5. Final result must not claim arbitrary configuration convergence.
+- ACK: additionally reproduced on both real storage backends in baseline-ack.log. The source revives `key=queued` with the deletion's timestamp after old queue event completion. Remove the stale assignment; storage preserves current state.
+- Storage lock recheck: reuse and keep existing error behavior. The tests establish per-hop behavior, not a production multi-site deployment or physical clock-skew experiment.
+
+## Added evidence
+
+`/Users/vonng/tmp/silo-r5-20260915-77ad/matrix_test.go` contains temporary signed HTTP UUID/null tests, exact SDK COPY wire capture, local timestamp inversion, multi-pool deletes and SSE-C rotation. The original matrix fails baseline as expected. `discussion-baseline.log` isolates R2's equal nonempty case, R3's real SDK shape, and R4's commit inversion. A short first compile missed a test import and was corrected; only the subsequent compile/run is behavioral evidence.
+
+The v2 plan, not this commentary, is the next consensus target. Production diff remains empty.
@@ -0,0 +1,111 @@
+Write is disabled in this session, so the review is delivered here in full.
+
+# Independent review — R5 repair plan v1
+
+**Reviewer model: `claude-opus-5` (Opus 5), effort max.** I read `docs/investigations/r5/plan-v1.md` completely, `docs/investigations/r5/baseline.md`, both raw logs, `baseline_test.go`, and then independently inspected the sender/receiver/storage chain at `9ebe81c1b`.
+
+**VERDICT: REQUEST_CHANGES** for plan v1 sha256 `fd6051527ebf19f624125bd3238da2f938420917226387c0f9373f1a98e87993`. Five blocking corrections (R1–R5). **No consensus is claimed.**
+
+Binding caveat, stated exactly: this session has read-only tools, so I did not execute `sha256sum`. I reviewed the file content at that path at the baseline SHA and cite the plan's own line numbers so you can bind findings to the hash.
+
+---
+
+## 1. Claims I confirmed from source (necessity, not inference)
+
+| Plan | Claim | Evidence | Verdict |
+|---|---|---|---|
+| L14 | PUT tagging stamps only when replication is selected; DELETE never stamps | `cmd/object-handlers.go:3762-3768`, `:3865-3870` | **correct** (and PUT uses two separate `UTCNow()` calls, 3765/3767) |
+| L14 | both write under the existing object lock; multi-pool updates the addressed version in each copy | `cmd/erasure-object.go:2272-2337`; `cmd/erasure-server-pool.go:3033-3075` | **correct** |
+| L15 | `putReplicationOpts` stamps only inside nonempty `UserTags`; multipart clears SourceMTime | `cmd/bucket-replication.go:849-863`, `:1776` | **correct** |
+| L16 | metadata COPY carries an explicit empty tag; ModTime default only for nonempty | `:747`, `:1692-1700`; SDK `copyObjectDo:262-264` writes the map verbatim | **correct** |
+| L18 | PUT / multipart initiation parse but never persist the source stamp | `cmd/object-api-options.go:473`; no writer anywhere in `cmd/` | **correct** (matches `baseline-extended.log:19-26`) |
+| L18 | multipart completion already rechecks the persisted upload under the object lock | `cmd/erasure-multipart.go:1161-1190` | **correct** |
+| L19 | `getReplicationAction` compares values/counts, not ordering time | `cmd/bucket-replication.go:1000-1005` | **correct** |
+| L20 | `checkPreconditionsPUT` skips matching version/ETag for non-SSE-C replicas | `cmd/object-handlers-common.go:233-247` | **correct**; and senders treat 412 as delivered (`:1466`; multipart `:1786-1788` returns `nil`) |
+| L21 | ACK callback copies stale `ri.UserTags` | `cmd/bucket-replication.go:1272-1274` | **correct, and worse than stated** |
+| L23 | `reconcileStoredObjectTags` gates as described | `cmd/erasure-server-pool-consistency.go:232-243` | **correct** |
+
+Two amplifiers the plan does not name, both strengthening it:
+
+- The ACK callback writes stale tags **without** a timestamp. The revived tag set therefore inherits the *deletion's newer* revision and propagates downstream as authoritative. Removal is the right fix and is sufficient: `er.PutObjectMetadata` preserves `fi.Metadata`'s tag key (`cmd/erasure-object.go:2260`) and `updatePoolMetadata` falls back to merged `UserTags` (`cmd/erasure-server-pool-consistency.go:194-214`).
+- The `encMetadata` merge at `cmd/object-handlers.go:1903` restores every reserved key snapshotted at `:1655-1659`; the guard at `:1855-1864` covers only the two Object Lock stamps. Tag revision is genuinely exposed, so L47 is justified.
+
+---
+
+## 2. Blocking disagreements
+
+### R1 — Do not synthesize a ModTime revision for objects with no tags and no revision
+**Where:** L35 ("otherwise object ModTime (also for empty legacy objects)") composed with L49 ("persist a nonzero parsed trusted source timestamp").
+
+**Evidence:** `PutObjectOptions.Header()` emits the header whenever `TaggingTimestamp` is non-zero (SDK `api-put-object.go:236-238`). If L35 moves selection outside the nonempty branch *and* defaults to ModTime, every replicated object — including every object that has never carried a tag — ships a non-zero stamp, and L49 persists it. Every object on the destination then owns a tag revision. Composed with L39 (recorded revision ⇒ force metadata replication), **every object at the next hop always selects metadata replication.** It also contradicts L10 ("not a reason to change the storage format") and L57 ("we do not invent historical deletion times").
+
+**Smallest correction:** send a stamp only when `objInfo.UserTags != ""` **or** a recorded revision exists. That keeps the tombstone case (empty + revision — the entire point), keeps the existing nonempty ModTime fallback, and drops only empty + no-revision, which L57 already declares unrecoverable. This makes §B consistent with §D.
+
+### R2 — Bound the forced metadata replication in `getReplicationAction`
+**Where:** L39.
+
+**Evidence:** the destination's revision is invisible to HEAD, so the condition never becomes false. Any object carrying a revision never returns `replicateNone` again: every heal, MRF retry and `ExistingObjectReplicationType` resync re-COPIES its metadata, rewriting `xl.meta` on the destination (and, multi-pool, running `retireReplicaCopies`) each pass. L39's "extra COPY only for already-scheduled work" understates a permanent non-convergence. Existing tests won't catch it — `newMatchingReplicationPair` (`cmd/bucket-replication_test.go:716-739`) carries no revision.
+
+**Smallest correction:** fire only when `oi1.UserTags == ""` and a revision is recorded — exactly the empty-to-empty tombstone L19 names and `TestReviewR5SameEmptyTagsMustTransferTimestamp` asserts. Nonempty states are already caught by the existing value/count comparison at `:1003`. Then state the residual: tag-deleted objects still never converge to `replicateNone`.
+
+### R3 — The production metadata COPY does not send `x-amz-metadata-directive: REPLACE`
+**Where:** L17.
+
+**Evidence:** `getCopyObjMetadata` sets `x-amz-tagging-directive: REPLACE` (`:748`) but never the metadata directive, so `getCpObjMetadataFromHeader` takes the `defaultMeta` branch (`cmd/object-handlers.go:1143,1165-1170`). Therefore:
+1. "its REPLACE metadata map also loses the previous timestamp before comparison" is **false on the production path** — `defaultMeta` preserves the stored revision. It is true only for a peer that does send REPLACE.
+2. The empty tombstone is dropped for a *different* reason than the plan gives: `defaultMeta` carries the stored `X-Amz-Tagging` forward and the `objTags != ""` gate at `:1817` skips the overwrite. (Note `X-Amz-Tagging` is in `supportedHeaders`, `cmd/handler-utils.go:84`, so on the REPLACE path the empty value *does* arrive in the map — only the stamp is missing.)
+3. The reproduction sends `x-amz-metadata-directive: REPLACE` (`baseline_test.go:134`), so it **does not pin the production request shape.** The conclusion still holds (with a stale stored stamp the delayed COPY wins either way), but the evidence chain as written is not the one production executes.
+
+**Smallest correction:** fix L17, and add a sender-shaped COPY case asserting against `getCopyObjMetadata` output rather than a hand-built header map.
+
+### R4 — Missing monotonic guard on the local revision at commit
+**Where:** L31 explicitly asks the reviewer to decide. My answer: commit-time *generation* is not required; a commit-time monotonic *guard* is.
+
+**Evidence:** `er.PutObjectTags` writes `fi.Metadata[x-amz-tagging]` and copies `opts.UserDefined` with **no ordering check** (`cmd/erasure-object.go:2328-2330`), and the handler mints the stamp *before* the namespace lock. R5 newly makes DELETE mint a revision, so a DELETE→PUT pair can invert — via lock queueing (`globalOperationTimeout` waits) or clock skew between the two nodes serving the two requests. Result: source holds `tags=X @ t_old`, replica holds the tombstone `@ t_new`. Every retransmit is then rejected by `reconcileStoredObjectTags` (`stamp.Before(incoming)` false), the sender still records **Completed**, and — with R2's rule — re-sends forever. Permanent, silent divergence: precisely the failure class R5 exists to remove, newly broadened by change A.
+
+**Smallest correction:** in `er.PutObjectTags`, under the lock, if the incoming revision is not strictly after the stored one, advance it to stored + 1ns. Multi-pool is safe without a second site of change: `z.PutObjectTags` writes identical tags to all copies, so any per-pool stamp differences still merge to a consistent `(tags, newest stamp)` pair through `mergedPoolObjectInfo` (`cmd/erasure-server-pool-consistency.go:124-131`).
+
+### R5 — Under-specified duplicate-suppression comparison
+**Where:** L51, "a valid newer source tag timestamp makes matching version/ETag insufficient".
+
+**Evidence:** read naively as "non-zero source stamp ⇒ bypass", this disables the duplicate guard for *every* tagged replica write; for multipart it re-uploads all parts, since 412 at initiation is currently the cheap exit (`:1786-1788`). `TestReviewR5NewerTagsMustBypassContentDuplicate` already encodes the correct comparison (source stamp vs. `oi`'s stored stamp), but the prose does not.
+
+**Smallest correction:** one sentence — "strictly newer than the destination's stored tag revision" — plus the cost note that even correctly scoped, this re-PUTs object data to deliver a tag-only change.
+
+---
+
+## 3. Accepted / non-blocking (state them; do not necessarily fix)
+
+- **§A local generation semantics** (L29): accepted as sufficient, subject to R4. Use one `UTCNow()` for both stamps as proposed.
+- **§B ACK removal** (L41): necessary and sufficient; preservation verified on both the single-pool and pooled write-back paths.
+- **§C `encMetadata` reconciliation** (L47): accepted. Today's observable effect is fail-closed (update dropped) when `ReplicaLockReconcile` is on, and a mismatched `(new tags, old stamp)` pair when `VersionID == ""` — worth one sentence.
+- **Equal timestamps:** adopting `reconcileStoredObjectTags` in the handler silently flips the non-versioned COPY path from "incoming wins on equal" (`cmd/object-handlers.go:1824`, `!ondiskTimestamp.After(srcTimestamp)`) to "stored wins on equal". This is the right direction and removes a real handler/storage inconsistency, but it is a compat-visible change and belongs in §D.
+- **Missing/invalid timestamps:** the gate asymmetry is correct as the plan describes — invalid *stored* ⇒ incoming wins; invalid *incoming* with valid stored ⇒ stored wins. Note the metadata COPY sender swallows parse errors (`:1696-1699`, `if err == nil`); L35's fail-loud rule should cover that call site too.
+- **Trust boundary: sound.** Stamp honored only under `trustedReplication` (`cmd/object-api-options.go:390-396`); headers stripped otherwise (`cmd/replication-trust.go:96-112,139-143`); client-supplied reserved headers rejected wholesale (`cmd/generic-handlers.go:75-85`). One asymmetry to resolve deliberately: the tag decision keys on `dstOpts.ReplicationRequest` (trusted marker) while Object Lock keys on `replicaTrusted` (marker + REPLICA). Production sets both.
+- **SSE-KMS / R4 boundary — more precise than the plan:** the KMS early return (`cmd/object-api-options.go:431-461`) drops `ReplicationSourceTaggingTimestamp`, so R5's PUT/multipart persistence is a **silent no-op for KMS-header requests** until R4 lands. The metadata-COPY leg is **not** affected: the public SSE header is synthesized only in responses (`cmd/api-response.go:525-533`), so `getCopyObjMetadata` never forwards it and tag deletions still order correctly for SSE-KMS objects via COPY. Say this instead of only "KMS combined tests after R4".
+- **Ordinary PUT/multipart with tags writes no revision,** so §A's invariant has a hole. Mostly masked by versioning; exposed on null/suspended versions, where `ReplicaLockReconcile` is off anyway (`:1847`, `:2432`). Either stamp there too (~3 lines) or document.
+- **Tag-filtered replication rules never see a deletion:** `FilterTargetArns` runs on the *post*-deletion `UserTags` (`cmd/bucket-replication.go:1189-1193`; `scheduleReplication` is called with the post-write `oi` at `cmd/object-handlers.go:3879`), so a rule with a tag filter yields no target. Pre-existing, but it bounds any completeness claim.
+- **Sender retries are otherwise clean:** `replicateAll` re-reads current state (`:1517`), so retries carry the current revision; staleness was confined to the ACK callback. No new HEAD protocol — agreed.
+- **UUID / null / versioned / multi-pool:** `metadataPoolInfos`, `mergedPoolObjectInfo`, `retireReplicaCopies` and the `nullVersionID` normalization (`:136-138`, `:1162-1168`) do carry tag state correctly; I found no additional loss path there beyond R4's clock inversion.
+
+---
+
+## 4. Can the proposed coverage establish the scope?
+
+**Can:** per-hop handler + storage behavior on real erasure disks (ErasureSD and 16-drive), multi-pool merge/retire through `consistencyPools` and the existing tag suite (`cmd/erasure-server-pool-tags_test.go`), sender option construction, and the ACK race with a deterministic interleave.
+
+**Cannot:** cross-site convergence, real clock skew, real lock contention. Both `ExecObjectLayerAPITest` instances run in one process against one clock. L73's "Not production multi-site acceptance" should be sharpened to say the suite establishes **per-hop** correctness only.
+
+**Must add:** (a) an untagged-object regression asserting **no** revision is synthesized (R1); (b) the sender-shaped metadata COPY (R3); (c) a DELETE→PUT inversion, by passing an older stamp directly at the storage call (R4); (d) equal-timestamp parity across the versioned and null-version COPY paths; (e) an SSE-KMS metadata COPY case marked blocked-on-R4. Also keep the three assertions inside `TestReviewR5DeleteThenDelayedTagUpdate` separable — once change A lands, the first passes and the later two silently depend on it.
+
+---
+
+## 5. Summary
+
+- **Accepted:** §12.1/.2/.3/.5/.6/.7/.8 defect claims; §A generation model; §B ACK removal; §C `encMetadata` reconciliation, storage-recheck reuse, multipart persistence; §D R4 ownership and the no-migration position.
+- **Non-blocking:** equal-timestamp behavior change, trust asymmetry, ordinary-PUT revision hole, tag-filtered rules, swallowed parse error in the COPY sender.
+- **Required (blocking):** R1 ModTime fallback scope; R2 forced-replication scope; R3 metadata-directive correction + sender-shaped test; R4 monotonic guard at commit; R5 duplicate-suppression comparison wording.
+
+Answering L75 directly: §A's existing local timestamp semantics are **not** sufficient without R4. §B's forced metadata synchronization is necessary but **wrongly scoped** (R1, R2); the stale ACK removal is necessary and correctly scoped. §C's duplicate exception is defensible but **under-specified** (R5). And yes — a path can still lose or revive the deletion revision: the DELETE→PUT local inversion (R4), plus the documented SSE-KMS PUT leg and tag-filtered-rule gaps.
+
+I recommend a v2 addressing R1–R5, then re-review against the new hash. I made no edits.
@@ -0,0 +1,45 @@
+{
+  "model": "claude-opus-5",
+  "effort": "max",
+  "plan_version": "v2",
+  "plan_sha256": "5a782acf3f285b23d1ae43a73481c4eb772a9a6d917fc5a550ecfc7cbf7446ca",
+  "baseline": "9ebe81c1b3611f9cc73e676b5b741c2be62c467a",
+  "actual_assistant_models": [
+    "claude-opus-5"
+  ],
+  "session_id": "1723246d-35c6-48de-9693-69f061427fcb",
+  "is_error": false,
+  "modelUsage": {
+    "claude-haiku-4-5-20251001": {
+      "inputTokens": 1578,
+      "outputTokens": 19,
+      "cacheReadInputTokens": 0,
+      "cacheCreationInputTokens": 0,
+      "webSearchRequests": 0,
+      "costUSD": 0.001673,
+      "contextWindow": 200000,
+      "maxOutputTokens": 32000,
+      "thinkingTokens": 0,
+      "canonicalModel": "claude-haiku-4-5",
+      "provider": "firstParty",
+      "costBasis": "list"
+    },
+    "claude-opus-5": {
+      "inputTokens": 28,
+      "outputTokens": 30031,
+      "cacheReadInputTokens": 709817,
+      "cacheCreationInputTokens": 79637,
+      "webSearchRequests": 0,
+      "costUSD": 1.9021934999999999,
+      "contextWindow": 1000000,
+      "maxOutputTokens": 64000,
+      "thinkingTokens": 23251,
+      "canonicalModel": "claude-opus-5",
+      "provider": "firstParty",
+      "costBasis": "list"
+    }
+  },
+  "result": "APPROVE_WITH_NONBLOCKING_NOTES",
+  "blocking_items": 0,
+  "raw_output": "/Users/vonng/tmp/silo-r5-20260915-77ad/opus-v2.jsonl"
+}
@@ -0,0 +1,7 @@
+Independent real Opus 5 at effort max follow-up review. Production sources remain exactly 9ebe81c1b3611f9cc73e676b5b741c2be62c467a; no fix implemented. Consensus target: docs/investigations/r5/plan-v2.md sha256 5a782acf3f285b23d1ae43a73481c4eb772a9a6d917fc5a550ecfc7cbf7446ca. Read that complete v2 plan, docs/investigations/r5/opus-v1-response.md, and your preserved docs/investigations/r5/opus-v1-review.md. Focus on the five prior blocking items and disposition; do not repeat a broad repository audit. Read precise source as needed to decide.
+
+R1 accepted (no empty/no-revision fallback). R3 confirmed against pinned SDK; actual SDK wire test now in /Users/vonng/tmp/silo-r5-20260915-77ad/matrix_test.go and /Users/vonng/tmp/silo-r5-20260915-77ad/discussion-baseline.log. R4 accepted plus a uniform multi-pool guard before per-set write, since normal GetObjectInfo/GetObjectNInfo can return primary pool and not merged latest revision. R5 explicit strictly-newer-than-stored. R2 challenged: same nonempty value at T1 and T3 can hide an intervening delete at T2; empty-only forcing would drop re-addition T3 and allow delayed delete. We accept one metadata COPY per explicitly scheduled retry/heal/resync for explicit revisions. Completed queueReplicationHeal returns early unless resync (cmd/bucket-replication.go ~3758); replicateObject requeues only Failed (~1305). No endless background loop is introduced. A new HEAD revision protocol seems more complexity than justified; evaluate the concrete correctness/cost tradeoff. Both equal-empty and equal-nonempty baseline action tests in discussion-baseline.log expose loss.
+
+Correct one nonblocking claim too: although COPY sender does not forward a public KMS header, destination bucket defaults/globalAutoEncryption apply BEFORE copyDstOpts (object-handlers.go 1425-1435), so COPY can still depend on R4. R4 has independently reproduced this. Plan documents tag-filter eligibility and unversioned content overwrite as pre-existing scope limits; per-hop guarantees only.
+
+Return APPROVE / APPROVE_WITH_NONBLOCKING_NOTES / REQUEST_CHANGES for this EXACT v2 and hash, with explicit blocker count and per-item resolution. If R2 is still blocking, provide the smallest concrete alternative that passes the X@T1/delete@T2/X@T3/reordered-delete case, not an empty-only suggestion. Do not claim consensus with remaining blockers. Do not edit or attempt Write; only return text. Model identity will be verified from raw assistant metadata.
@@ -0,0 +1,43 @@
+Write is disabled for this task by your instruction, so the review is returned in full as text. No files were created or edited.
+
+# Independent follow-up review — R5 repair plan v2
+
+**Reviewer model: `claude-opus-5` (Opus 5), effort max.** Read: `docs/investigations/r5/plan-v2.md` (complete), `opus-v1-response.md`, my preserved `opus-v1-review.md`, plus `/Users/vonng/tmp/silo-r5-20260915-77ad/matrix_test.go` (discussion cases) and `discussion-baseline.log`. Source re-read at `9ebe81c1b` only where an item's disposition depended on it.
+
+**VERDICT: APPROVE_WITH_NONBLOCKING_NOTES** for `docs/investigations/r5/plan-v2.md`, consensus target sha256 `5a782acf3f285b23d1ae43a73481c4eb772a9a6d917fc5a550ecfc7cbf7446ca`. **Blocking items remaining: 0 (zero).** All five v1 blockers are resolved; R2 I withdraw as a blocker on the evidence below.
+
+Same binding caveat as v1, unchanged: this session has Glob/Grep/Read only, so I did not execute `sha256sum`. I reviewed the file at that path in this worktree at the stated base and cite its line numbers so findings bind to the hash.
+
+## Per-item resolution
+
+| Item | Status | Basis |
+|---|---|---|
+| **R1** empty/no-revision ModTime fallback | **Resolved** | Plan L35 is exactly my v1 correction: revision-when-recorded, existing nonempty ModTime fallback retained, empty + no revision sends nothing. §B and §D (L61) are now consistent. |
+| **R2** forced metadata replication scope | **Resolved — my correction was wrong; I withdraw the blocker** | See below. |
+| **R3** production COPY request shape | **Resolved, with wire evidence** | `TestTaggingProductionCopyWireShape` (matrix_test.go:436-459) drives the real `minio.Core.CopyObject` against an httptest peer: `metadata-directive="" tagging-directive="REPLACE"` plus the tagging timestamp header (log line 6). L17 now states both shapes and requires covering a peer that sends metadata REPLACE. |
+| **R4** local revision inversion | **Resolved and correctly strengthened** | L31's uniform multi-pool requirement is necessary, and **my v1 note was wrong** — see correction 2. `TestLocalTaggingCommitCannotRegressRevision` encodes max-across-pools + 1ns in the response and every copy; it fails baseline (log line 9: stamp stays `01:00:00Z`). |
+| **R5** duplicate-suppression wording | **Resolved** | L51 is explicit: valid source revision *strictly newer than the destination's stored tag revision*, `olderThan` semantics, client preconditions preserved, re-upload cost documented. |
+
+## R2 adjudication — why I withdraw it
+
+**My proposed restriction was incorrect.** `TestTaggingRepeatedValueNeedsRevisionDelivery` (matrix_test.go:422-435) runs both rows; baseline returns `replicateNone` for equal `""` **and** for equal `"key=same"` with a revision an hour newer (log lines 2-3). An empty-only condition fixes only the first row, so it does not repair X@T1 / delete@T2 / X@T3 with a reordered delete. The scenario is reachable: `er.PutObjectTags` never touches `fi.ModTime` (`cmd/erasure-object.go:2328-2332`), so the full-copy gate `oi1.ModTime.Unix() != oi2.LastModified.Unix()` (`:975-981`) never fires on tagging-only changes and the value comparison at `:1003` is decisive; concurrent workers for the same object are not serialized by revision, and at `:1600-1625` a `replicateNone` result is force-marked Completed, making the loss permanent and silent.
+
+**My cost rationale is refuted by source, not merely by assertion.** `queueReplicationHeal` returns at `cmd/bucket-replication.go:3768` for `Completed && VersionPurgeStatus.Empty() && !mustResync()`; `replicateObject` requeues only non-Completed at `:1306`. I also checked the feedback path I would have raised in its place: `mustReplicate` returns an empty decision for an incoming replication request (`:270-272`), so a forced COPY cannot schedule a new event at the destination — no active-active ping-pong. And the blast radius is **narrower than the plan claims**: `ObjectReplicationType` dispatches to `ri.replicateObject` (`:1233-1237`), which never calls `getReplicationAction`, so the extra COPY applies only to Metadata/Heal/ExistingObject types.
+
+**Concrete tradeoff against a HEAD revision protocol.** The sender already extends the HEAD (`sOpts.Set(xhttp.AmzTagDirective, "ACCESS")`, `:1595`), so the idea is not absurd — but the pinned SDK's `extractObjMetadata` (`minio-go@v7.3.1-0.20260910142817.../utils.go:232-277`) preserves only the whitelist plus `x-amz-meta-`/`X-Minio-Meta-`; any `x-minio-internal-*` response header is discarded. Exposing the revision therefore needs (a) a new target-side response header, in a client-visible namespace or behind an SDK whitelist change, (b) a sender-side read path, and (c) a fallback for peers that do not answer — and that fallback is the forced COPY anyway. Strictly more code, a new cross-version wire contract, and the same worst case. The plan's choice is right; L39 already states the residual cost honestly.
+
+## Corrections to my own v1 non-blocking claims
+
+1. **KMS / COPY (as you flagged).** My v1 line — "the metadata-COPY leg is **not** affected" — is wrong. The sender indeed forwards no public SSE header, but `CopyObjectHandler` applies the destination bucket's SSE config and `globalAutoEncryption` to `r.Header` at `cmd/object-handlers.go:1428-1433`, *before* `copyDstOpts` → `putOptsFromReq` → `putOpts` → `putOptsFromHeaders`, whose `crypto.S3KMS.IsRequested(hdr)` branch (`cmd/object-api-options.go:431-461`) returns an ObjectOptions carrying the legal-hold and retention timestamps but **not** `ReplicationSourceTaggingTimestamp`. So COPY does depend on R4 whenever the destination bucket has default KMS or auto-encryption is on. Plan L59 states this correctly; do not adopt my broader exclusion.
+2. **Multi-pool merge.** My v1 R4 note claimed per-pool stamp differences merge safely via `mergedPoolObjectInfo`. They do not on ordinary reads: `z.GetObjectInfo` → `getLatestObjectInfoWithIdx` (`cmd/erasure-server-pool.go:1121`, `:1032-1072`) returns one pool's `ObjectInfo`, sorted by ModTime with a lowest-index tiebreak — and ModTime is identical across copies for tagging changes. `mergedPoolObjectInfo` is reached only from `replicaObjectInfo` and `updatePoolMetadata` (`cmd/erasure-server-pool-consistency.go:135-147`, `:169-174`). Since the replication sender reads through `GetObjectNInfo`, it can emit a stale primary-pool revision. L31's uniform value is required.
+
+## Non-blocking notes for v2
+
+- **Tighten the cost statement** in L39 to Metadata/Heal/ExistingObject types only (`ObjectReplicationType` bypasses the predicate). It makes the accepted cost smaller and the test targets sharper.
+- **Add a termination regression** asserting `mustReplicate` yields no decision for the incoming forced COPY (`:270-272`). That property, not the scanner gates alone, is what makes the rule terminating under bidirectional configurations.
+- **Assert ModTime invariance across tagging** (`:2328-2332`). If a future change ever bumped ModTime on tagging, the equal-value skip disappears and the whole cost calculus shifts; a one-line assertion pins the premise.
+- **Multi-pool guard mechanics.** `z.PutObjectTags` returns `copies[0]`'s result (`cmd/erasure-server-pool.go:3059-3067`) and is bypassed entirely for `SinglePool()` (`:3035-3036`). Keep the guard in `er.PutObjectTags` as the invariant holder, have it advance only when the passed value is not strictly newer than that set's stored value, and have the response report what was actually written. Transient per-set divergence from a direct-to-set write outside the pool lock re-converges on the next z-level write; say so rather than implying it cannot happen.
+- **`replicateNone` branch side effect.** Revisioned objects now reach `applyAction` instead of the force-Completed path at `:1614-1624`, so a failed COPY becomes Failed + MRF rather than a phantom Completed, and `rinfo.ReplicationAction` flips `none`→`metadata`. Right direction; cover the metrics path once.
+- **Sender parse asymmetry.** The receiver fails closed on a malformed tag timestamp (`cmd/object-api-options.go:421-424`) while the COPY sender swallows it (`cmd/bucket-replication.go:1695-1700`). L35/L37 covers this; just confirm the COPY call site is in scope, since it is a different function from `putReplicationOpts`.
+
+I made no edits, launched no agents, and executed nothing. No implementation is proposed or requested here, so I am not calling ExitPlanMode.
@@ -0,0 +1,75 @@
+# R5 repair plan v1 — tag deletion and ordered replication
+
+Status: proposed, no production implementation before real Opus consensus.
+Base: `9ebe81c1b3611f9cc73e676b5b741c2be62c467a` (local and GitHub main checked).
+
+## Problem and necessity
+
+A tag value and its `x-minio-internal-tagging-timestamp` form one state, including an empty value. Successful DeleteObjectTagging currently leaves the old timestamp. A delayed, authenticated metadata COPY newer than that old timestamp restores deleted tags. The parent and this worktree reproduce this through signed HTTP with real single-drive and 16-drive storage. An empty incoming COPY is also ignored.
+
+The consequence is persistent incorrect user metadata on the source or replicas, affecting tag-based access/lifecycle behavior. Repair is justified before claiming replication correctness. It is not a reason to change the supported PGSTY dependency graph, storage format, encryption protocol, or Object Lock behavior.
+
+## Current chain and additional gaps
+
+1. `PutObjectTaggingHandler` stamps only when replication is selected. `DeleteObjectTaggingHandler` never stamps. Both storage methods write the value under the existing object lock; multi-pool PutObjectTags updates the addressed version in each copy.
+2. `putReplicationOpts` sets the timestamp only inside nonempty UserTags. Multipart uses this builder and clears SourceMTime at initiation, so using initiation time as a tag fallback would be wrong.
+3. Metadata COPY carries an explicit empty tag via `getCopyObjMetadata`, but only defaults its timestamp to object ModTime for nonempty tags.
+4. `CopyObjectHandler` branches on nonempty tags; its REPLACE metadata map also loses the previous timestamp before comparison.
+5. `PutObjectHandler` and `NewMultipartUploadHandler` parse the source timestamp but never persist it in metadata. Multipart completion already rechecks the upload's persisted metadata against the addressed destination version under the object lock.
+6. `getReplicationAction` compares tag values/counts, not their ordering time. An empty-to-empty deletion revision can be declared complete without transmitting the revision.
+7. `checkPreconditionsPUT` skips matching version/ETag for non-SSE-C replicas even when their tag revision is newer. This affects PUT and multipart initiation. Explicit client If-Match/If-None-Match checks must still apply.
+8. `replicateObject`'s completion metadata callback copies nonempty `ri.UserTags` from the old queue snapshot. A deletion committed before this worker's current-object read can be overwritten at acknowledgment. A status update must retain the tags read under its own metadata lock.
+
+The existing storage fix (`3ce831925`) already supplies `reconcileStoredObjectTags` in PUT, COPY, multipart completion and all-pool reconciliation. Its strict ordering keeps stored state on equal timestamps and keeps a valid stored revision against missing/invalid incoming timestamps. Reuse these gates, do not replace them.
+
+## Proposed minimal changes
+
+### A. Produce local revisions
+
+In both PUT tagging and DELETE tagging handlers, allocate opts.UserDefined if needed and assign a single UTCNow RFC3339Nano tag revision for each authorized mutation, independent of current replication selection. Use the same time for ReplicationTimestamp when replication is selected. This also covers empty PUT tagging and mutations while replication is disabled. Persist through existing PutObjectTags/DeleteObjectTags locks. Ordinary COPY must write an empty REPLACE tag and a fresh tag timestamp too.
+
+This preserves the existing wall-clock conflict model, not a new distributed causal clock. The timestamp is generated before the storage lock as in existing PUT tagging. Reviewer should explicitly assess whether a commit-time generation change is necessary for this scoped repair; if necessary, revise before implementing. Clock skew and simultaneous conflicting equal revisions cannot be completely ordered by this protocol.
+
+### B. Transport complete state
+
+Move tag timestamp selection outside the nonempty-value branch in putReplicationOpts. Use recorded RFC3339Nano time when present, otherwise object ModTime (also for empty legacy objects). Malformed recorded timestamps fail option construction rather than being silently treated as fresh.
+
+Use the same selection for metadata COPY; a small shared timestamp helper is acceptable to prevent inconsistent error/fallback rules. Preserve explicit empty tag REPLACE metadata. Multipart initiation retains this timestamp even though SourceMTime is cleared.
+
+When getReplicationAction sees a recorded tag revision after the existing identity/full-copy checks, select metadata replication even if visible values match: HEAD does not expose that revision. Do not change the existing null-version resync exclusion. This is an extra COPY only for already-scheduled work with an explicit revision, including retry/heal; it does not add scans or network calls on ordinary object reads. Avoid a new HEAD protocol merely to save that COPY.
+
+Remove the stale ri.UserTags assignment from replication completion metadata write-back. The callback changes replication status only; existing metadata write-back preserves the current tags and timestamp.
+
+### C. Accept, order, and persist
+
+COPY captures the stored UserTags and timestamp before metadata reconstruction. For a trusted replication request with a nonzero source timestamp, install the incoming tag value (including empty) with that timestamp, then reuse reconcileStoredObjectTags against the captured state. A missing source timestamp preserves stored state for metadata COPY. Storage rechecks under its lock, including all pools. Equal timestamps keep stored state. Ordinary COPY generates a fresh revision for its chosen tags, including empty.
+
+Ensure the final encMetadata merge cannot restore a stale tag timestamp over the accepted pair (SSE-C rotation snapshots reserved keys). Reconcile the timestamp entry in encMetadata with the tag decision before merging, using the existing lock-timestamp pattern.
+
+PUT and multipart initiation persist a nonzero parsed trusted source timestamp into the existing metadata map before entering storage. Their existing lock/reconcile flags retain the newest state. Completion takes tag state from the persisted upload, not client-supplied completion headers, and orders it again against current state.
+
+For trusted REPLICA PUT/multipart initiation, a valid newer source tag timestamp makes matching version/ETag insufficient to skip the request. Preserve explicit If-Match/If-None-Match and existing SSE-C behavior. Duplicate/equal/older non-SSE-C writes may keep their existing no-op/412 behavior; the sender treats these as already delivered. Completion does not set PreserveETag and does not need a new duplicate exception.
+
+### D. Boundaries and compatibility
+
+R4 owns object-api-options.go SSE-KMS common-field preservation. R5 will not implement it. R4 will provide a reviewed patch for isolated combined KMS verification. R5 owns the handlers, sender and tag-related duplicate exception.
+
+No migration: historical deletions with missing/wrong timestamps have irrecoverably lost ordering information. We do not invent historical deletion times or rewrite production state. A fresh authenticated tagging mutation after upgrade produces an ordered state. Upgrade both sender and receiver for complete guarantees; older peers may continue to drop empty revisions. No main merge, push, release or deployment is authorized here.
+
+## Verification matrix
+
+- Re-run parent overlay on exact HEAD; preserve raw failures. Extend temporary reproduction for PUT/multipart lost persistence, empty-to-empty sender decision, and matching-content newer revision skip.
+- Signed HTTP tag PUT/delete, active replication and no selected replication, empty PUT, repeated DELETE; check response and persisted tag/time, worker scheduling when active.
+- COPY old/new/equal/missing/invalid source time, empty/nonempty, metadata COPY/REPLACE, explicit UUID/null version; protect unrelated/latest versions and local empty COPY.
+- Production putReplicationOpts/SDK headers and actual metadata sender requests: explicit empty tombstone, legacy ModTime fallback, nanoseconds, malformed timestamp. Equal empty values must still send ordered deletion; exercise retry after failed send.
+- PUT and multipart through signed requests/SDK: first receipt, newer removal, older replay after removal, duplicate receipt, missing timestamp. For multipart, mutate tags between initiation and completion and check final disk state.
+- Multi-pool real-storage fixture with duplicate UUID/null versions, newer tag state in secondary pool, all-pool persistence/retirement; reuse current tag storage suite and failure-closed coverage. Include a deterministic update after handler snapshot to show storage lock recheck.
+- Old queued replication event followed by deletion: process event and confirm source completion callback cannot restore tags; check tag/time after reread.
+- Run related replication trust, Object Lock/SSE-C retransmit, tag storage and API precondition tests; targeted race tests, gofmt, git diff --check. No whole-repository tests in parallel with other R tasks without need.
+- KMS combined dependent tests only after R4 reviewed change is available. Report R5-only and combined results separately.
+
+## Work and acceptance
+
+Estimated 2–4 engineer days including replication boundary tests and review. The patch should remain localized; added regression code is expected to exceed production LOC. Completion requires a reviewable diff, actual Opus model/effort record, same-plan consensus, meaningful persisted-state tests, and explicit local versus merge/release state. Not production multi-site acceptance.
+
+Review questions: Are A's existing local timestamp generation semantics sufficient here? Are B's forced metadata synchronization, stale ACK removal and C's narrow duplicate exception necessary and correctly scoped? Is any incoming/forwarding/multi-pool path still able to lose or revive the deletion revision?
@@ -0,0 +1,81 @@
+# R5 repair plan v2 — tag deletion and ordered replication
+
+Status: proposed v2, responding to real Opus v1 REQUEST_CHANGES; no production implementation before consensus.
+Base: `9ebe81c1b3611f9cc73e676b5b741c2be62c467a` (local and GitHub main checked).
+
+## Problem and necessity
+
+A tag value and its `x-minio-internal-tagging-timestamp` form one state, including an empty value. Successful DeleteObjectTagging currently leaves the old timestamp. A delayed, authenticated metadata COPY newer than that old timestamp restores deleted tags. The parent and this worktree reproduce this through signed HTTP with real single-drive and 16-drive storage. An empty incoming COPY is also ignored.
+
+The consequence is persistent incorrect user metadata on the source or replicas, affecting tag-based access/lifecycle behavior. Repair is justified before claiming replication correctness. It is not a reason to change the supported PGSTY dependency graph, storage format, encryption protocol, or Object Lock behavior.
+
+## Current chain and additional gaps
+
+1. `PutObjectTaggingHandler` stamps only when replication is selected. `DeleteObjectTaggingHandler` never stamps. Both storage methods write the value under the existing object lock; multi-pool PutObjectTags updates the addressed version in each copy.
+2. `putReplicationOpts` sets the timestamp only inside nonempty UserTags. Multipart uses this builder and clears SourceMTime at initiation, so using initiation time as a tag fallback would be wrong.
+3. Metadata COPY carries an explicit empty tag via `getCopyObjMetadata`, but only defaults its timestamp to object ModTime for nonempty tags.
+4. `CopyObjectHandler` branches on nonempty tags. Production getCopyObjMetadata + SDK Core.CopyObject sends tagging REPLACE but no metadata directive, so its default metadata map retains the old timestamp. A peer using metadata REPLACE additionally loses that timestamp before the handler comparison. Cover both shapes; the empty-value skip affects both.
+5. `PutObjectHandler` and `NewMultipartUploadHandler` parse the source timestamp but never persist it in metadata. Multipart completion already rechecks the upload's persisted metadata against the addressed destination version under the object lock.
+6. `getReplicationAction` compares tag values/counts, not their ordering time. An empty-to-empty deletion revision can be declared complete without transmitting the revision.
+7. `checkPreconditionsPUT` skips matching version/ETag for non-SSE-C replicas even when their tag revision is newer. This affects PUT and multipart initiation. Explicit client If-Match/If-None-Match checks must still apply.
+8. `replicateObject`'s completion metadata callback copies nonempty `ri.UserTags` from the old queue snapshot. A deletion committed before this worker's current-object read can be overwritten at acknowledgment. A status update must retain the tags read under its own metadata lock.
+
+The existing storage fix (`3ce831925`) already supplies `reconcileStoredObjectTags` in PUT, COPY, multipart completion and all-pool reconciliation. Its strict ordering keeps stored state on equal timestamps and keeps a valid stored revision against missing/invalid incoming timestamps. Reuse these gates, do not replace them.
+
+## Proposed minimal changes
+
+### A. Produce local revisions
+
+In both PUT tagging and DELETE tagging handlers, allocate opts.UserDefined if needed and assign a single UTCNow RFC3339Nano tag revision for each authorized mutation, independent of current replication selection. Use the same time for ReplicationTimestamp when replication is selected. This also covers empty PUT tagging and mutations while replication is disabled. Persist through existing PutObjectTags/DeleteObjectTags locks. Ordinary COPY must write an empty REPLACE tag and a fresh tag timestamp too.
+
+Under the existing storage write lock, guard local tagging revisions against regression: a valid supplied tag revision not strictly after the valid stored revision is advanced to stored + 1ns. Do this in er.PutObjectTags; for multi-pool writes, z.PutObjectTags first computes one revision strictly beyond every addressed copy and passes that identical value to all sets. This is necessary because ordinary replication source reads/returned primary ObjectInfo can observe one physical pool; merely allowing different pool revisions with equal values can send a revision older than an already-replicated tombstone. Only explicit valid local tag revisions are advanced; replicated PUT/COPY/multipart retain strict source ordering, and direct storage calls without a supplied revision retain current legacy semantics. Generate before locking as today; the guard runs under the lock. Preserve the requested map from unintended shared mutation. This is a per-object monotonic guard in the existing RFC3339Nano domain, not a new wire clock. Equal independent remote conflicting revisions still keep stored state; arbitrary distributed clock skew is not totally ordered by this protocol.
+
+### B. Transport complete state
+
+Move tag timestamp selection outside the nonempty-value branch in putReplicationOpts. Use recorded RFC3339Nano time when present even for an empty value. Without a recorded revision, retain the existing ModTime fallback only for nonempty tags; empty + no revision sends no timestamp. This avoids inventing a tombstone for never-tagged/historically unordered objects. Malformed recorded timestamps fail option construction rather than being silently treated as fresh.
+
+Use the same selection for metadata COPY; a small shared timestamp helper is acceptable to prevent inconsistent error/fallback rules. Preserve explicit empty tag REPLACE metadata. Multipart initiation retains this timestamp even though SourceMTime is cleared.
+
+When getReplicationAction sees a recorded tag revision after the existing identity/full-copy checks, select metadata replication even if visible values match: HEAD does not expose that revision. Keep this for empty AND nonempty states. Example: destination key=X@T1, source deleted at T2 and re-added key=X@T3; if the equal nonempty state skips T3, delayed delete T2 incorrectly removes X. An empty-only condition does not fix ordered deletion/re-addition. Preserve existing null-version resync exclusion. Cost: every explicitly scheduled retry/heal/resync for an object with a recorded revision may require a metadata COPY, even if already converged. It does not create a background retry loop: queueReplicationHeal returns early for Completed objects without requested resync (bucket-replication.go around 3758), and replicateObject requeues only failed results (around 1305). Successful copies remain Completed. Never-tagged objects retain the old skip optimization under the preceding rule. Accept the extra metadata I/O during explicit resync as the smallest correctness-complete option; avoid introducing an authenticated HEAD revision protocol solely as an optimization.
+
+Remove the stale ri.UserTags assignment from replication completion metadata write-back. The callback changes replication status only; existing metadata write-back preserves the current tags and timestamp.
+
+### C. Accept, order, and persist
+
+COPY captures the stored UserTags and timestamp before metadata reconstruction. For a trusted replication request with a nonzero source timestamp, install the incoming tag value (including empty) with that timestamp, then reuse reconcileStoredObjectTags against the captured state. A missing source timestamp preserves stored state for metadata COPY. Storage rechecks under its lock, including all pools. Equal timestamps keep stored state. Ordinary COPY generates a fresh revision for its chosen tags, including empty.
+
+Ensure the final encMetadata merge cannot restore a stale tag timestamp over the accepted pair (SSE-C rotation snapshots reserved keys). Reconcile the timestamp entry in encMetadata with the tag decision before merging, using the existing lock-timestamp pattern.
+
+PUT and multipart initiation persist a nonzero parsed trusted source timestamp into the existing metadata map before entering storage. Their existing lock/reconcile flags retain the newest state. Completion takes tag state from the persisted upload, not client-supplied completion headers, and orders it again against current state.
+
+For trusted REPLICA PUT/multipart initiation, a valid source tag timestamp strictly newer than the destination's stored tag revision makes matching version/ETag insufficient to skip the request. Use the existing olderThan predicate (zero never wins, valid source beats missing/invalid stored). Preserve explicit If-Match/If-None-Match and existing SSE-C behavior. Duplicate/equal/older non-SSE-C writes may keep their existing no-op/412 behavior; the sender treats these as already delivered. Completion does not set PreserveETag and does not need a new duplicate exception. This narrow exception can re-upload data to carry a tag-only revision; normal metadata work uses COPY, while full retransmission must not silently acknowledge a newer revision it did not persist.
+
+### D. Boundaries and compatibility
+
+R4 owns object-api-options.go SSE-KMS common-field preservation. R5 will not implement it. R4 will provide a reviewed patch for isolated combined KMS verification. R5 owns the handlers, sender and tag-related duplicate exception.
+
+Compatibility: equal-timestamp COPY consistently keeps stored state, including unqualified and explicit null requests; this aligns with existing storage tie behavior and changes the old unqualified handler incoming-wins tie. Preserve the existing tag trust predicate (trusted replication marker) and stronger ReplicaLockReconcile predicate (trusted marker + REPLICA and addressed version), without expanding trust. Production replication supplies both.
+
+Scope limitations: ordinary full object PUT/multipart creation retain their existing nonempty ModTime fallback; this change does not order independent unversioned content replacements against one another. Existing tag-filter target eligibility can exclude post-deletion empty tags; target-selection semantics are not changed here. This work guarantees correct tag ordering along selected per-hop replication requests, not every replication-rule configuration. Destination bucket-default/global-auto KMS is applied before copyDstOpts (object-handlers.go 1425-1435), so COPY can depend on R4 even when the sender does not forward an explicit encryption header. PUT/multipart KMS also require R4.
+
+No migration: historical deletions with missing/wrong timestamps have irrecoverably lost ordering information. We do not invent historical deletion times or rewrite production state. A fresh authenticated tagging mutation after upgrade produces an ordered state. Upgrade both sender and receiver for complete guarantees; older peers may continue to drop empty revisions. No main merge, push, release or deployment is authorized here.
+
+## Verification matrix
+
+- Re-run parent overlay on exact HEAD; preserve raw failures. Extend temporary reproduction for PUT/multipart lost persistence, empty-to-empty sender decision, and matching-content newer revision skip.
+- Signed HTTP tag PUT/delete, active replication and no selected replication, empty PUT, repeated DELETE; check response and persisted tag/time, worker scheduling when active.
+- COPY old/new/equal/missing/invalid source time, empty/nonempty, metadata COPY/REPLACE, explicit UUID/null version; protect unrelated/latest versions and local empty COPY.
+- Production putReplicationOpts/SDK headers and actual metadata sender requests: explicit empty tombstone, nonempty legacy ModTime fallback, no fabricated empty legacy revision, nanoseconds, malformed timestamp. Equal empty values must still send ordered deletion; equal nonempty values must send re-addition revisions to defeat intervening delayed deletions. Pin actual SDK metadata COPY headers, and cover peer metadata REPLACE independently. Exercise retry after failed send.
+- PUT and multipart through signed requests/SDK: first receipt, newer removal, older replay after removal, duplicate receipt, missing timestamp. For multipart, mutate tags between initiation and completion and check final disk state.
+- Multi-pool real-storage fixture with duplicate UUID/null versions, newer tag state in secondary pool, all-pool persistence/retirement; reuse current tag storage suite and failure-closed coverage. Include a deterministic update after handler snapshot to show storage lock recheck. A local DELETE-to-PUT inversion with supplied older timestamp must produce one revision greater than the maximum across pools, in both response and every stored copy.
+- Old queued replication event followed by deletion: process event and confirm source completion callback cannot restore tags; check tag/time after reread.
+- Run related replication trust, Object Lock/SSE-C retransmit, tag storage and API precondition tests; targeted race tests, gofmt, git diff --check. No whole-repository tests in parallel with other R tasks without need.
+- KMS combined dependent tests only after R4 reviewed change is available. Report R5-only and combined results separately.
+
+## Work and acceptance
+
+Estimated 2–4 engineer days including replication boundary tests and review. The patch should remain localized; added regression code is expected to exceed production LOC. Completion requires a reviewable diff, actual Opus model/effort record, same-plan consensus, meaningful persisted-state tests, and explicit local versus merge/release state. Establishes per-hop behavior with deterministic clock/commit interleaves; not production multi-site or real host-clock-skew acceptance.
+
+## v2 review focus
+
+See `opus-v1-response.md` for every blocking/nonblocking disposition and exact counterarguments. R1/R3/R4/R5 accepted with concrete changes. R2 is disputed as proposed: empty-only forced transfer is insufficient for same-value re-addition after deletion, and Completed scanner gates bound work. Please adjudicate on this v2 hash, not on general preference for avoiding metadata I/O. Do not treat unresolved disagreement as consensus.
@@ -0,0 +1,135 @@
+TestPeerBucketCorsReplicationOrdering
+TestSiteReplicationMetaInfoPreservesCorsTombstone
+TestSiteReplicationStatusDetectsCorsTimestampMismatch
+TestSiteReplicationStatusCountsCorsPerSite
+TestCORSReplicationStateOrdering
+TestCORSReplicationStatusStateEquality
+TestNewBucketCORSReplicationEvent
+TestCorsReplicationDispatchStatusHealReload
+TestMarshalUnmarshalReplicationMRFStats
+TestEncodeDecodeReplicationMRFStats
+TestMarshalUnmarshalBucketReplicationResyncStatus
+TestEncodeDecodeBucketReplicationResyncStatus
+TestMarshalUnmarshalReplicationState
+TestEncodeDecodeReplicationState
+TestMarshalUnmarshalTargetReplicationResyncStatus
+TestEncodeDecodeTargetReplicationResyncStatus
+TestCompositeReplicationStatus
+TestReplicationResyncwrapper
+TestReplicationValidationObjectUsesRulePrefix
+TestGetReplicationActionEmptyObjectLockValues
+TestReplicationActionForTargetRetentionRemoval
+TestReplicationActionForTargetNullVersionResync
+TestReplicationActionForTargetTimestampOnlyRemoval
+TestMarshalUnmarshalBucketReplicationStat
+TestEncodeDecodeBucketReplicationStat
+TestMarshalUnmarshalBucketReplicationStats
+TestEncodeDecodeBucketReplicationStats
+TestMarshalUnmarshalReplicationLastHour
+TestEncodeDecodeReplicationLastHour
+TestMarshalUnmarshalReplicationLastMinute
+TestEncodeDecodeReplicationLastMinute
+TestMarshalUnmarshalReplicationLatency
+TestEncodeDecodeReplicationLatency
+TestMarshalUnmarshalReplicationQueueStats
+TestEncodeDecodeReplicationQueueStats
+TestAPISSECCompressionReplicaStaysReadable
+TestSSECBatchReplicationCannotRead
+TestAPIDeleteObjectVersionDenyAndReplicationCompatibility
+TestAPISSECReplicaPartNumberReads
+TestAPISSECReplicaMalformedPartIsRejected
+TestPoolsDeleteVersionAPI
+TestPoolsDeleteVersionUnreadablePool
+TestPoolsDeleteVersionSingleCopy
+TestPoolsDeleteVersionReplicationPurge
+TestPoolsDeleteVersionCleanupFailure
+TestPoolsDeleteVersionCallbacks
+TestPoolsDeleteVersionSpecialCalls
+TestPoolsDeleteUnversionedFanout
+TestPoolsConditionalDeleteVersionSelection
+TestPoolsConditionalDeleteDuplicateVersion
+TestPoolsConditionalDeleteReportsOtherPoolFailure
+TestPoolsConditionalDeleteSerializesPut
+TestPoolsConditionalDeleteSerializesCompletion
+TestPoolsReplicaSerializesMetadataAndHealing
+TestPoolsConditionalDeletePreservesVersionHistory
+TestPoolsReplicaIndependentLockWinners
+TestPoolsReplicaSoleDrainingOwner
+TestPoolsMetadataUpdateUsesMergedVersion
+TestPoolsReplicaMetadataCopyReconcilesLockAndTags
+TestPoolsReplicaCleanupFailureCanRetry
+TestPoolsRetiringCopyPreservesSharedTierObject
+TestPoolsDeleteVersionAfterInterruptedRebalance
+TestPoolsDeleteDirectoryMarker
+TestPoolsMultipartConditionalUsesLogicalLatest
+TestPoolsMultipartConditionalHTTPMatrix
+TestPoolsMultipartConditionalHTTPAbsentObject
+TestPoolsMultipartConditionalHTTPNormalRouting
+TestPoolsMultipartConditionalUnreadablePool
+TestPoolsMultipartConditionalLatestVersionAndCallbackOnce
+TestPoolsMultipartConditionalConcurrentCompletes
+TestPoolsMultipartConditionMatrix
+TestPoolsMultipartConditionBoundaries
+TestPoolsMetadataUpdatePreservesTags
+TestReplicaWritesPreserveTagOrdering
+TestMergedPoolObjectInfoTagOrdering
+TestPoolsMetadataCallbackReplacesTags
+TestReconcileStoredObjectTagOrdering
+TestPoolsMetadataUpdatePreservesAbsentTags
+TestExtractReplicationMetadataHeaders
+TestGetCopyObjectMetadataFromHeaderReplication
+TestCloneRequestWithoutReplicationHeaders
+TestIAMServiceAccountReplicationRejectsOtherCredentialKinds
+TestIAMServiceAccountReplicationPreservesExpiration
+TestPutOptsFromHeadersReplicationTimestamps
+TestAPIGetObjectAttributesSSECReplicationAuthz
+TestAPICopyObjectSSECKeyRotationReplicaKeepsFastPath
+TestAPIFederatedCopyObjectRejectsRawSSECReplica
+TestAPICopyObjectReplicaTaggingTimestampUnderKMS
+TestCheckPreconditions
+TestAPIPutObjectReplicationHeaderPoisoning
+TestAPICopyObjectReplicationHeaderPoisoning
+TestPostPolicyCannotForgeReplicationStatus
+TestReplicationMRFDropsVisible
+TestReplicationObjectDeleteWorkerAffinity
+TestAPISSECReplicationTargetHead
+TestAPISSECReplicaRetransmitOverExistingVersion
+TestPutReplicationOptsRetentionRemoval
+TestAPISSECReplicaWriteExemptionIsKeyedOnTheIncomingWrite
+TestAPISSECReplicaRetransmitObjectLockOrdering
+TestAPISSECReplicaRetransmitMultipartObjectLockOrdering
+TestPutReplicationOptsRetentionRemovalTimestampOnly
+TestAPIReplicaMarkerOnlyAppliesObjectLock
+TestAPIReplicaMultipartNewerHoldSurvivesCompletion
+TestAPITaggingReplicationOrdering
+TestAPITaggingReplicationOrderingKMS
+TestAPITaggingMultipartCommitRechecksRevision
+TestAPILocalTaggingAlwaysAdvancesRevision
+TestTaggingTimestampWire
+TestAPIPoolsTaggingReplicaDeletion
+TestAPITaggingSSECRotationPreservesDeletionRevision
+TestTaggingRepeatedValueNeedsRevisionDelivery
+TestTaggingProductionCopyWireShape
+TestLocalTaggingCommitCannotRegressRevision
+TestTaggingReplicaContentDuplicateGuard
+TestAPITaggingUnqualifiedCopyOrdering
+TestTaggingReplicationSenderRetryAndAcknowledgment
+TestAPISSECReplicaSkipsDestinationTransforms
+TestAPISSECMultipartReplicaRoundTripWithCompression
+TestPutReplicationOptsRejectsCompressedSSEC
+TestAPIReplicationTrustProtectsSSECReads
+TestReplicationTrustControlsInternalOptionsAndEvents
+TestAPIPutObjectReplicationTrust
+TestAPISnowballReplicationTrustIsPerEntry
+TestAPIDeleteObjectReplicationTrust
+TestAPISSECMultipartReplicationTrust
+TestAPIStreamingTrailerWithUntrustedReplicationHeaders
+TestAPICopyObjectReplicaLegalHoldTimestamp
+TestAPICopyObjectReplicaAbsentLockFieldsPreserveNewerState
+TestAPICopyObjectReplicaRetentionRemovalKeepsOrderingTimestamp
+TestAPICopyObjectReplicaObjectLockOrdering
+TestAPICopyObjectReplicaRetentionRemovalUnderBucketKMS
+TestAPICopyObjectReplicaLockTimestampSurvivesSSECKeyRotation
+TestBucketPolicyReplicationKey
+TestBucketPolicyReplicationStatusLegacyOrder
+TestSiteReplicationStatusAccountsPerSiteAndSurvivesMalformedConfig
@@ -0,0 +1,38 @@
+# Current-baseline reproduction
+
+Base: `9ebe81c1b3611f9cc73e676b5b741c2be62c467a`. Go 1.27.1, macOS arm64. Production sources unchanged. Temporary overlay injects regression tests; real erasure disks persist object metadata. Capacity adapter changes only reported capacity to avoid the developer machine's unrelated disk-usage threshold.
+
+## Commands and raw evidence
+
+Raw directory: `/Users/vonng/tmp/silo-r5-20260915-77ad/`.
+
+```sh
+GOMAXPROCS=2 go test -p 1 -overlay /Users/vonng/tmp/silo-r5-20260915-77ad/overlay.json ./cmd -run '^TestReviewR5' -count=1 -v
+GOMAXPROCS=2 go test -p 1 -overlay /Users/vonng/tmp/silo-r5-20260915-77ad/overlay.json ./cmd -run '^TestReviewR5Queued' -count=1 -v
+```
+
+Both exit 1, as expected before repair. Files: `baseline.log`, `baseline-extended.log`, `baseline-ack.log`; the full injected source is `baseline_test.go`.
+
+## Observations
+
+| Regression | Observed result |
+|---|---|
+| Empty source tags with explicit revision | putReplicationOpts returns zero TaggingTimestamp |
+| Signed HTTP DELETE on a versioned object with replication selected | 204, empty tags, one queued event, unchanged old timestamp |
+| Delayed signed trusted COPY after DELETE | 200 and deleted tags restored |
+| Newer empty signed COPY | 200, old nonempty tags/time remain |
+| First signed replica PUT carrying tag timestamp | 200, timestamp absent in stored object |
+| First signed replica multipart initiation carrying timestamp | 200, timestamp absent in persisted upload metadata |
+| Equal empty source/target values, source has newer deletion revision | getReplicationAction returns none |
+| Same ETag/version with newer trusted source tag revision | checkPreconditionsPUT skips request |
+| Process an old queued tagging event after a stored deletion | replication completes; source ACK restores `key=queued` with the deletion timestamp |
+
+All HTTP/storage cases above ran on both ErasureSD (one real disk) and Erasure (16 real disks). The last case uses a local HTTP protocol peer for replication responses and the real source object layer. It manually persists the deletion revision before processing the old queue snapshot to isolate the ACK defect from the separate DELETE-handler defect. The worker reads current deleted tags, yet its completion callback restores stale queue tags.
+
+These are component/in-process HTTP integration results, not multi-site production acceptance.
+
+## Provenance
+
+Current git history attributes introduction of ReplicationSourceTaggingTimestamp in COPY to upstream `c4373ef29` (2021-09-18, multi-site replication). COPY sender timestamps were added in `3781a0f9a` (2023-12-13), with default tag timestamps in `64a8f2e55` (2025-02-04). Queue-snapshot tag reassignment traces to `fa6d082bf` (2023-09-16). The storage tag reconciliation fix `3ce831925` is already present in this baseline and does not cover the HTTP/transport or queue-ACK omissions.
+
+No historical state can prove a missing deletion time. The planned repair records future revisions; a production backfill would need separate authoritative evidence and authorization.
@@ -0,0 +1,88 @@
+{
+  "environment": {
+    "go": "go1.27.1 darwin/arm64",
+    "GOMAXPROCS": "2",
+    "go_test_p": "1"
+  },
+  "new_r5_tests": {
+    "count": 13,
+    "exit_code": 0,
+    "log": "/Users/vonng/tmp/silo-r5-20260915-77ad/fixed-targeted-latest.log",
+    "runtime_seconds": 9.161
+  },
+  "related_selection": {
+    "selected_top_level_tests": 135,
+    "first_capacity_adapted_run": {
+      "passed": 134,
+      "failed": 1,
+      "failure": "POST fixture still used host capacity; XMinioStorageFull",
+      "exit_code": 1,
+      "log": "/Users/vonng/tmp/silo-r5-20260915-77ad/related-suite-capacity-final.log"
+    },
+    "remaining_post_and_strengthened_pool_test": {
+      "passed": 2,
+      "failed": 0,
+      "exit_code": 0,
+      "log": "/Users/vonng/tmp/silo-r5-20260915-77ad/final-post-and-pools.log"
+    },
+    "all_135_selected_tests_passed_across_batches": true,
+    "unfiltered_full_cmd_package_pass": false
+  },
+  "race": {
+    "command": [
+      "go",
+      "test",
+      "-race",
+      "-p",
+      "1",
+      "./cmd",
+      "-run",
+      "^(TestAPITagging.*|TestAPIPoolsTaggingReplicaDeletion|TestAPILocalTaggingAlwaysAdvancesRevision|TestTagging.*|TestLocalTaggingCommitCannotRegressRevision|TestReplicaWritesPreserveTagOrdering|TestMergedPoolObjectInfoTagOrdering|TestReconcileStoredObjectTagOrdering)$",
+      "-count=1",
+      "-v"
+    ],
+    "environment": {
+      "GOMAXPROCS": "2"
+    },
+    "log": "/Users/vonng/tmp/silo-r5-20260915-77ad/targeted-race-final.log",
+    "exit_code": 0,
+    "duration_seconds": 121.658,
+    "passed_top_level_tests": 16,
+    "race_diagnostics": 0
+  },
+  "verifiers": {
+    "command": [
+      "make",
+      "verifiers",
+      "GOLANGCI=/Users/vonng/tmp/silo-r5-20260915-77ad/golangci-lint-serial"
+    ],
+    "environment": {
+      "GOMAXPROCS": "2"
+    },
+    "log": "/Users/vonng/tmp/silo-r5-20260915-77ad/make-verifiers-serial.log",
+    "exit_code": 0,
+    "duration_seconds": 203.553,
+    "wrapper": "Same repository-pinned lint binary with --allow-serial-runners to wait for the shared host lint lock."
+  },
+  "build": {
+    "command": [
+      "make",
+      "build"
+    ],
+    "environment": {
+      "GOMAXPROCS": "2"
+    },
+    "log": "/Users/vonng/tmp/silo-r5-20260915-77ad/make-build.log",
+    "exit_code": 0,
+    "duration_seconds": 35.043,
+    "built_worktree_base": "dbcf8dec589deb5d91e17d295cb70997635f5b55",
+    "source_manifest": "docs/investigations/r5/final-implementation-manifest.json",
+    "version_exit_code": 0,
+    "version_output": "silo version DEVELOPMENT.2026-09-15T15-56-31Z (commit-id=dbcf8dec589deb5d91e17d295cb70997635f5b55)\nRuntime: go1.27.1 darwin/arm64\nLicense: GNU AGPLv3 - https://www.gnu.org/licenses/agpl-3.0.html\nCopyright: 2015-2025 MinIO, Inc.\nModifications: Copyright 2025-2026 PGSTY\nSource compatibility: based on MinIO technology"
+  },
+  "limits": [
+    "Existing TestReplicationResync order-dependent panic reproduced on the unpatched production baseline; passes in isolation on both versions.",
+    "Existing test capacity uses recorded test-only overlays, with real I/O and errors preserved.",
+    "Unfiltered full cmd package and production multi-site validation remain unperformed."
+  ]
+}
@@ -0,0 +1,57 @@
+# R5 local verification
+
+## Scope and source identity
+
+This is a local repair of ordered tag deletion along selected replication requests. It does not authorize or establish a main merge, push, release, deployment, historical-state migration, or production multi-site acceptance.
+
+- Research baseline: `9ebe81c1b3611f9cc73e676b5b741c2be62c467a`.
+- Combined verification dependency: R4 `dbcf8dec589deb5d91e17d295cb70997635f5b55`; R5 does not modify `cmd/object-api-options.go`.
+- Accepted plan: v2, SHA256 `5a782acf3f285b23d1ae43a73481c4eb772a9a6d917fc5a550ecfc7cbf7446ca`.
+- Actual plan reviewer: `claude-opus-5`, explicit max effort; v1 requested changes, v2 approved with nonblocking notes and zero blockers. See `consensus.md`.
+- Actual implementation reviewer: the same requested/observed model and effort, `GO_WITH_NONBLOCKING_NOTES`, zero blockers. Original review identity and hashes are in `opus-implementation-metadata.json`.
+- `implementation-manifest.json` identifies the reviewed patch. `final-implementation-manifest.json` identifies the final source after a stronger multi-pool test assertion and gofumpt formatting. All seven production file hashes still match the review.
+
+## Executed regression checks
+
+All commands run from this worktree with `GOMAXPROCS=2` and `go test -p 1`, Go `go1.27.1 darwin/arm64`. Raw logs are in `/Users/vonng/tmp/silo-r5-20260915-77ad/`.
+
+| Check | Observed result | Evidence |
+|---|---|---|
+| New R5 tests before implementation | Reproduced real signed-HTTP deletion resurrection, empty COPY loss, full-write persistence/skip, equal-value sender skip, local revision inversion and stale source ACK | `baseline*.log`, `discussion-baseline.log`; `reproduction.md` |
+| Latest complete new R5 selection | 13 top-level tests passed, 9.161s | `fixed-targeted-latest.log` |
+| Related selection, host capacity adapted | 134 passed; one POST fixture still failed the host minimum-free threshold, 56.007s | `related-suite-capacity-final.log`; exact 135 names in `related-test-names.txt` |
+| Remaining POST test plus strengthened multi-pool replay test | Both passed, 3.232s; completes the 135-name selection across the two batches | `final-post-and-pools.log` |
+| Existing `TestReplicationResync` in isolation | Passed on baseline (2.191s) and R5 (1.776s) | `baseline-resync.log`, `fixed-resync-isolated.log` |
+| Final R5 plus tag-storage race selection | 16 top-level tests passed, 25.584s runtime, no race diagnostics | `targeted-race-final.log`; exact command/exit in `final-check-results.json` |
+| Repository verifiers | Passed: lint 0 issues, generated files unchanged, branding/compatibility and entrypoint checks passed | `make-verifiers-serial.log`, `verifiers-result.json` |
+| Repository build and binary invocation | `make build` passed; the resulting `silo --version` exited 0 | `make-build.log`, `build-result.json`, `silo-version.log` |
+
+The selected regressions include existing replication trust/header poisoning, API preconditions, Object Lock, SSE-C retransmission, R4 KMS option/COPY tests, and pool metadata/cleanup/retry checks. The new R5 suite covers:
+
+- Local PUT tags, repeated DELETE, empty PUT and ordinary empty COPY; tag revisions advance even without selected replication, while local tagging preserves object ModTime.
+- Empty/nonempty and newer/stale/equal/missing revisions through signed COPY with both metadata directives, PUT and multipart; UUID/null and unqualified COPY; unrelated newer versions survive.
+- Multipart deletion committed between initiation and completion, with the upload's saved revision checked at initiation and ordered again at completion.
+- Exact SDK sender headers, nanosecond precision, legacy fallback only for nonempty tags, and rejection of malformed recorded times.
+- Equal-value metadata resend, failed COPY reporting/retry, no incoming-replica requeue, and a stale queued source ACK preserving the current deletion.
+- Uniform local tag revisions beyond every physical pool, deterministic inverted request/commit timestamps, normal-routing readback after replay and inspection of every retained pool copy.
+- Destination KMS encryption/readback and signed SSE-C key rotation with decrypted GET. These are local handler/storage fixtures, not an encrypted-source-to-encrypted-destination two-site deployment.
+
+## Baseline and environment failures retained
+
+The first broad selection panics at `TestReplicationResync` before any R5 test executes. Replacing all seven R5 production files with the R4 baseline, and hiding the two new tests in a Go overlay, reproduces the same panic after the same preceding tests (`baseline-related-suite.log`). The test passes alone on both versions. The remaining 135-name selection therefore runs separately; this is not reported as an unfiltered full-package pass.
+
+This host's used-space percentage makes existing allocation tests return `XMinioStorageFull`. The test-only overlays add the existing `tagTestCapacityDisk` via `r5Capacity` at the API/pool fixture boundaries and the final POST fixture. The adapter changes reported capacity only, delegates real I/O and propagates disk errors. The exact overlays, original/modified fixture hashes and diffs are retained as `capacity-fixture*` and `capacity-post*`. No fixture overlay or capacity-policy change enters production code.
+
+The first adapted link and first verifier run also failed actual `ENOSPC` when the volume had about 200–500 MiB available (`related-suite-capacity.log`, `make-verifiers.log`). Regenerable Go cache data untouched for three days was reclaimed with an exact manifest (`cache-reclaim.json`); subsequent successful checks are distinguished from those failures. A subsequent verifier caught gofumpt formatting in the new helper; that formatting was corrected before final validation.
+
+An earlier KMS multipart fixture used a single-PUT ETag with multipart data layout and failed decryption. Seeding a real multipart source fixed the fixture; the subsequent complete run passed plaintext readback. The failed log remains `fixed-targeted.log`, and this is not attributed to a production encryption change.
+
+## Local delivery and remaining integration gates
+
+Required scoped local checks are complete. `validation-results.json` records command results, and `evidence-manifest.json` identifies the raw files and binary by SHA256. The build compiled the working source identified by `final-implementation-manifest.json`; the Makefile stamped its pre-commit dependency ID `dbcf8dec5` into this local development binary. Final source identity is established by the file hashes, not by that pre-commit version label.
+
+An unfiltered full `cmd` run and real multi-site deployment remain future integration gates before any separately authorized merge/release. Known scope limits are retained in plan v2 and `implementation-review-response.md`: tag-filter target eligibility, historical missing revisions, malformed stored source times, legacy peers dropping empty revisions, and arbitrary distributed clock skew.
+
+The verifier uses the repository-pinned golangci-lint v2.13.1 through a local wrapper adding only `--allow-serial-runners`. This waits for the shared host lint lock instead of running another lint process concurrently. The first unscheduled attempt was rejected by that lock (`make-verifiers-success.log`; despite that filename, its recorded exit is 2). The final serialized run passed. The optional `typos` binary is unavailable and was skipped by the Makefile.
+
+R4 has since merged as `af2b1794d38d9e70e1d2c3ee692426e4b6cab4bd` (PR #193). `dependency-handoff.json` verifies that its production options file and both test bodies match the dependency used above. The other differences are test license headers and R4 review/validation documents. The R5 delivery base is this exact merged dependency, with the old unsigned `dbcf8dec5` ancestor removed. The original recorded plan/review baseline remains intact as historical evidence. The final local commit, clean-worktree check and post-rebase file-hash comparison are recorded outside the commit in `/Users/vonng/tmp/silo-r5-20260915-77ad/final-delivery.json`.
@@ -0,0 +1,71 @@
+# R6：delete-marker purge 与 MRF 修复
+
+## 当前交付状态
+
+本地实现已完成，v3 已与真实 Opus 5.0 达成共识。原研究基线和同步到主干快照后的定向回归、race、完整构建、vet、lint 全部通过；此前受宿主机容量限制的六项 DELETE 测试，在空间恢复后也全部通过。
+
+- 研究基线：`9ebe81c1b3611f9cc73e676b5b741c2be62c467a`。
+- 集成基线：`af2b1794d38d9e70e1d2c3ee692426e4b6cab4bd`；通过最终验证的源码提交：`cf381a7151ef25fc95ace5fedcd767fa19410de2`。后续提交仅整理本目录的验证文档。
+- 分支：`codex/r6-delete-marker-mrf`。
+- [PR #184](https://github.com/pgsty/silo/pull/184) 在最终核对时仍为 OPEN，head `6addf9eb916b5a4b837480cf534cd1efa5407d3c`。复用其按 purge 状态识别操作、接纳 marker 405 的方向，补齐实测遗漏；没有直接合并该 PR。
+- 从研究基线到集成基线，仅新增 R4 的 SSE-KMS PUT 选项与对应材料，R6 涉及的生产文件、测试文件和依赖未发生交叉修改。五个 R6 文件在同步前后的 SHA256 一致。
+- 本任务没有执行主干合并、远端推送、发布、部署或现网存量改写。
+
+## 修复内容
+
+| 操作 | 远端行为 | 结果与源端写回 |
+|---|---|---|
+| marker 创建 | 保留 HEAD 已存在/就绪检查及创建语义 | 更新创建状态；405 可以表示已创建 |
+| 规范版本 purge | 发送指定 versionId 的永久删除 | 只更新 purge 状态，保留磁盘创建/replica 字段 |
+| 旧 marker 形态 purge | 从任务级 purge 状态识别，沿用规范永久删除请求 | 不再被创建 COMPLETED 跳过；失败进入 MRF；已完成 purge 不重发 |
+
+- 离线、DELETE 拒绝、成功与 resync 出口使用操作自己的状态；失败 purge 不写成功 reset 标记。源端 purge 写回显式清空三个“创建更新”字段，避免多目标空状态被旧正则误解析后覆盖磁盘创建记录。
+- MRF 接受携带正确 marker、版本、对象、桶和非零时间的 405；其它错误或无效信息不调度删除。
+- 删除任务携带重试计数；锁失败、复制失败、工作队列满三个入 MRF 出口都递增。耗尽现有预算后继续保留 scanner 恢复路径。
+- purge 的内部 COMPLETE 保持不变；操作审计使用规范 COMPLETED，失败为 FAILED。按目标状态变化更新统计，成功 heal purge 的统计为次数增加、字节数为零。
+- 不改 wire 格式、MRF 磁盘格式、共享正则、复制状态合并框架或依赖版本。
+
+## 真实 Opus 共识
+
+使用本机 Claude Code 2.1.270，每轮显式指定 `claude-opus-5 --effort max`。全部记录到的 assistant 模型均为 `claude-opus-5`；实际调用成功，未用模拟评审或限流失败代替同意。
+
+| 方案 | 结论 | 处置 |
+|---|---|---|
+| v1 | REVISE，1 个阻断 | 接受意见：不能用本次目标子集重写完整创建状态 |
+| v2 | GO_WITH_NONBLOCKING_NOTES | 共识后实现；随后用真实存储发现多目标空状态正则反例 |
+| v3 | GO_WITH_NONBLOCKING_NOTES，0 阻断 | reviewer 撤回过强的旧证明，确认三字段清空方案；共识后应用并验证 |
+
+最终不可变方案：[plan-v3.md](plan-v3.md)，SHA256 `dc9a67fc91b3113fa35218a2f903455807430cc4daf9c78a88d0be6b8fc27058`。
+详见 [完整共识及逐项处置](consensus.md)、[研究与 #184 审查](research.md)、[v3 原始评审正文](opus-v3-review.md)。模型只读权限不允许计算哈希；它核对了具体文件内容，本任务在评审前后计算并确认哈希不变。评审不替代执行验证。
+
+## 验证范围
+
+原基线证据：[机器记录](verification/baseline-verification.json)。最终集成证据：[五项检查记录](verification/rebased-verification.json)、[六项 DELETE 复验](verification/rebased-delete-verification.json)、[源码与方案哈希清单](final-source-manifest.json)。对应日志在同目录，均与原始日志逐字节一致。运行环境：Go 1.27.1，darwin/arm64，GOMAXPROCS=4。
+
+| 检查 | 最终结果 |
+|---|---|
+| `go test -p 2 ./cmd ./internal/bucket/replication -run 'TestReplication\|TestReplicate\|TestMRF\|TestResync\|TestSiteResync' -count=1 -v` | 通过，28 个顶层测试 / 198 个通过条目 |
+| `go test -race -p 2 ./cmd -run 'TestReplicateDelete\|TestReplicationMRF\|TestReplicationDeleteQueueFull' -count=1 -v` | 通过，无数据竞争报告 |
+| `go build -p 2 ./...` | 通过 |
+| `go vet -p 2 ./cmd ./internal/bucket/replication` | 通过 |
+| golangci-lint 2.13.1，仓库配置，`--build-tags kqueue` | 通过，0 issues |
+| 原容量失败的六项 DELETE 测试，按完整测试名精确复跑 | 六项全部通过 |
+
+- 28 个顶层定向测试通过，包含 198 个通过条目（含子测试）。
+- 单盘、16 盘真实 erasure 存储；真实源端签名 DELETE、minio-go HTTP、源/目标 marker 元数据。
+- 失败 → MRF 文件持久化 → 新 ReplicationPool 读取 → 真实 marker+405 lookup → 工作队列 → 生产 replicateDelete → 恢复。
+- 覆盖创建/旧新 purge、部分目标重试、两目标一成一败/离线、远端已删除但响应丢失、重试预算耗尽和 scanner 接管；恢复后核对源和目标 marker 最终状态。
+- 两个目标空状态的实际存储反例已转绿；所有 purge 写回均通过断言确认创建字段为空，完整创建/replica 元数据和时间戳保留。
+- 验证实际审计 webhook 的 FAILED/COMPLETED，以及失败/成功统计变化；race 未报告数据竞争。
+
+**边界：** 目标为受控 HTTP 适配器，调用真实 ObjectLayer；测试显式消费队列并执行生产复制函数，直接驱动 MRF 保存，没有启动后台定时器和完整 worker 循环。这是三端点 fan-out 与磁盘恢复验证，不是三台独立 SILO 进程的站点复制集群、接收端认证或进程崩溃验收。
+
+首次扩大测试中，六项无关 DELETE 测试在种子数据写入时触发宿主机容量阈值，该次测试未通过。空间恢复后，保持代码不变精确复跑六项，全部通过；这不等于运行了整个 cmd 测试集。R6 存储夹具使用仓库现有容量适配器，数据仍真实落盘。一次测试链接遇到磁盘空间耗尽，清理可确认属于本任务的旧 Go 缓存后复验。详情和中间失败记录：[verification-notes.md](verification-notes.md)。
+
+## 仍然独立的事项
+
+当前 DELETE/scanner/heal/resync 已产生规范 purge；旧任务形态不会序列化跨重启，不能宣称所有失败 purge 永久卡住。本修复主要恢复活跃的 marker MRF 路径，并完善旧形态兼容。
+
+未覆盖或未修改：缺失客户端导致的目标状态遗漏、目标级 resync 的既有 purge 子集替换、复制跟踪已丢失、replica relay、purge 后延迟创建且无 tombstone、源端元数据写失败依赖 scanner、共享解析器的通用健壮性、额外 backoff/指标设计。完整多进程站点验收应另行安排。
+
+原始大日志与临时复现：`/Users/vonng/tmp/silo-r6-20260915-aa3f/`。每轮 metadata 记录模型、命令、基线、方案及原始输出哈希。
@@ -0,0 +1,53 @@
+# R6 plan consensus — final v3
+
+2026-09-15. Source baseline: `9ebe81c1b3611f9cc73e676b5b741c2be62c467a`.
+
+Earlier v2 agreed immutable plan: [plan-v2.md](plan-v2.md), SHA256 `dae51753a3ab4b2ea98b85e720144338fdf52541ca6daf968c7dac5ce564d8c3`.
+
+Codex accepts this plan. Real Claude Code 2.1.270, explicitly `--model claude-opus-5 --effort max`, read the same file and returned **GO_WITH_NONBLOCKING_NOTES, no blockers**, with explicit consensus. Every recorded assistant model in both rounds is `claude-opus-5`. CLI auxiliary usage is listed separately in the metadata files. The reviewer had read-only tools, so verified content but did not independently compute the hash; Codex computed the hash before and after review and confirmed it unchanged. The plan is 59 lines as described by the reviewer. A `rate_limit_event` telemetry record is not a failure verdict: the actual final result is `subtype=success, is_error=false`, and includes the explicit review and consensus.
+
+| Round | Verdict | Outcome |
+|---|---|---|
+| v1 | REVISE, one blocker | Accepted B1: preserve the disk creation block using the existing empty-update signal. All seven notes resolved/scoped in decisions-v2.md. No production code changed. |
+| v2 | GO_WITH_NONBLOCKING_NOTES | Same immutable plan accepted by both parties; implementation and tests now proceed. |
+
+Raw logs: `/Users/vonng/tmp/silo-r6-20260915-aa3f/opus-v1.jsonl`, `opus-v2.jsonl`, and matching stderr logs. Extracted reviews and SHA/model/command metadata are alongside this document. No simulated reviewer or fallback model was substituted.
+
+## v2 nonblocking dispositions
+
+1. Keep canonical success audit normalization COMPLETE → COMPLETED, using replication.CompletedLegacy for conversion; assert the actual audit outcome and document the visible string correction.
+2. Use operation status for per-target change comparisons. Assert count-only successful heal purge deltas, zero bytes, and no pending operation outcome for failed purges. No new metrics policy.
+3. Initialize ResetStatusesMap before an existing assignment when nil, unconditionally safe; no general merge change.
+4. Already-COMPLETE purge also short-circuits under ExistingObjectReplicationType, matching canonical behavior; add a matrix row.
+5. Offline errors populate Err for both creation and purge. This is explicit error reporting with the same failed outcome.
+6. Preserve getReplicationState's existing unused third parameter and shape-agnostic behavior.
+7. Validate real marker/nonempty version/nonzero ModTime plus bucket and decoded object identity. Use decodeDirObject for the name comparison so the stricter gate does not reject the internal directory-object encoding.
+8. Use int for delete RetryCount, matching the persisted MRF field and QueueReplicationHeal input. No on-disk format changes.
+9. Purge-status subset replacement is pre-existing and remains outside R6; creation-block preservation under partial fan-out is newly tested.
+10. Tests drive saveMRFEntries directly, verify the real stored record, and create a fresh pool for each load/queue replay. Timer waiting and process-crash durability are not claimed.
+
+These are implementation refinements within the accepted plan; Opus explicitly stated they require no new review round/hash. Consensus is not test acceptance, merge, release or deployment. Production implementation begins only after this record was written.
+
+
+## Final v3 consensus, 2026-09-16 CST
+
+Final immutable plan: [plan-v3.md](plan-v3.md), SHA256 `dc9a67fc91b3113fa35218a2f903455807430cc4daf9c78a88d0be6b8fc27058` (70 lines; locally recomputed unchanged after review).
+
+Codex accepts v3. Real `claude-opus-5 --effort max` returned GO_WITH_NONBLOCKING_NOTES, no blockers, and explicit consensus on the exact read content. As before, read-only reviewer tools could not compute the digest; the model verified the named content and Codex verified its hash. Original review/metadata are opus-v3-review.md and opus-v3.metadata.json. The review candidly withdraws the earlier multi-target regex proof. This is actual additional review, not a simulated amendment to the earlier output.
+
+The v2 implementation was completed only after v2 agreement. Codex then found and reproduced the two-empty-status parser counterexample on real storage; the incremental three-field v3 source change remained unapplied until this new consensus was recorded.
+
+| v3 note | Disposition |
+|---|---|
+| N1 payload invariant | Accepted as mandatory: wrap the real ObjectLayer update in purge tests and assert all three creation-update fields and their composite are empty. |
+| N2 masking scope | Ordinary purges are protected through FileInfo.Deleted=false; ordinary object versions have another such guard. The unrecorded marker case corrupts creation metadata only on its first failed write. |
+| N3 ReplicaStatus | Clearing it is defensive, not a repair of an observed producer population. |
+| N4 shared parser | Remains unchanged; generic parser robustness is separate. No future arbitrary caller guarantee is claimed. |
+| N5 timestamp assignment | Retained; empty creation-update payload makes it irrelevant to purge disk creation metadata. |
+| N6 prior proof | v2's regex proof is correct only for a single target. The immutable raw reviews and executable counterexample are both retained. |
+
+Only v3's three field assignments and the required invariant remain to be applied after this record. All earlier compatible refinements and acceptance limits still stand.
+
+## Implementation completion, 2026-09-16 CST
+
+The paragraph above records the state at approval time. The agreed v3 assignments and mandatory payload invariant have since been implemented and verified. After rebasing onto `af2b1794d38d9e70e1d2c3ee692426e4b6cab4bd`, all five R6 source/test hashes remained identical. Source commit `cf381a7151ef25fc95ace5fedcd767fa19410de2` passed the scoped regression, race, build, vet and lint checks, plus the six formerly capacity-blocked DELETE tests. See [README.md](README.md) and its linked machine verification records. Subsequent changes only document this evidence; no new production-plan deviation was introduced.
@@ -0,0 +1,18 @@
+# R6 v1 review disposition
+
+Actual reviewer: Claude Code 2.1.270, assistant model `claude-opus-5`, explicit effort max. Original verdict REVISE, one blocker; see opus-v1-review.md and opus-v1.metadata.json. No consensus or production implementation at this stage.
+
+| Item | Disposition | v2 change / evidence |
+|---|---|---|
+| B1 creation-status pin rewrites a partial target set | Accepted. The disk no-update semantics are preferable and smaller. | Purge results leave ReplicationStatus empty, only VersionPurgeStatus changes; assert full persisted creation state and timestamp across partial fan-out/repeated failure. No generic state merge rewrite. |
+| N1 wire version fallback | Accepted. | Existing DeleteMarkerVersionID fallback retained; tests assert query version and false marker flag for every purge shape. |
+| N2 queue-full retry budget | Accepted. | All three queueMRFSave sites for deletes increment RetryCount, including queueReplicaDeleteTask. |
+| N3 completion statistics change | Accepted. | Check concrete Heal/ExistingObject counter deltas for COMPLETE-to-COMPLETED conversion. |
+| N4 null/empty versions | Accepted as current boundary. | 405 recovery requires a real nonempty identity; empty/null special cases remain outside acceptance. |
+| N5 live producer/old-shape scope | Accepted. | Old tasks are not serialized; robustness path distinguished from currently active MRF defect. |
+| N6 detached MRF execution | Accepted. | Real disk persistence each round, new pool, synchronized queue receives with bounded timeout, no sleeping for presumed completion. |
+| N7 fixture threshold | Resolved with actual execution. | Existing capacity adapter; baseline canonical and old scanner recovery pass. PR MRF canonical recovery completes on single/16-drive fixtures; old-shape failure still queues zero entries. |
+
+Correction to our research inference: a canonical purge's empty returned creation result causes replicatedInfos.ReplicationStatus() to report PENDING, but that does NOT show loss of the disk creation block. xlMetaV2 skips that block update when the composite creation status is empty. The temporary probe's in-memory assertion was too strong; do not promote it into a disk-state defect. The PR old-shape missing-MRF observation and all target-branch observations remain valid.
+
+The local-source metadata-write error path and missing-client/purge-subset merge behavior are explicitly documented acceptance limits. They are not new claims of convergence. v2 does not broaden the repair into those independent mechanisms.
@@ -0,0 +1,39 @@
+{
+  "recorded_at_utc": "2026-09-15T16:31:10.707976+00:00",
+  "research_base": "9ebe81c1b3611f9cc73e676b5b741c2be62c467a",
+  "integration_base": "af2b1794d38d9e70e1d2c3ee692426e4b6cab4bd",
+  "verified_source_commit": "cf381a7151ef25fc95ace5fedcd767fa19410de2",
+  "branch": "codex/r6-delete-marker-mrf",
+  "source_sha256": {
+    "cmd/bucket-replication.go": "999c2818a8980cbeb55cfcbc244840069fb44e042b4b4d6ef7668c2660ce31e0",
+    "cmd/bucket-replication-utils.go": "365641c760901641e8320cc5123697ab92a46f1add612048b991ed2d1cfad43b",
+    "cmd/replication-delete-marker_test.go": "d967787804d558ac6266b113228fdf4a4f9fcb7cab39138a4fb07558814ccca4",
+    "cmd/replication-delete-operation_test.go": "2888a04a543324776041316de2821f388d28c3c1a6f5d0031e5ac9d34f58d504",
+    "cmd/replication-delete-mrf_test.go": "5e160f7e19cbbb8cd5fa4e7ffd9cff9e09361b3fc4c5ee5ae61458f99c777781"
+  },
+  "source_patch_sha256": "f374335371c9c6bed00fe453a6e10270bedcc1f1f391bfc09338664b3f50d886",
+  "source_patch_raw_path": "/Users/vonng/tmp/silo-r6-20260915-aa3f/final-integrated-source.diff",
+  "dependency_and_lint_config_sha256": {
+    "go.mod": "8351bb86377a8deed95fd0bd67c1e363e11d33f8da7631cea8f68cea11259976",
+    "go.sum": "2287ce975cab91f92f59a3b6e164d49325f141f35d480b8c3d23f796df3772b2",
+    ".golangci.yml": "b18a20eb81da3e8714ba3d9cdf404913b7c8e011fe6958ff7f10e6410a4573ba"
+  },
+  "final_plan": {
+    "path": "plan-v3.md",
+    "sha256": "dc9a67fc91b3113fa35218a2f903455807430cc4daf9c78a88d0be6b8fc27058"
+  },
+  "opus_metadata_sha256": {
+    "opus-v1.metadata.json": "22b8d6b27a1112441b070bae096641eb5f0d2f954ddfe3fd88e17e0377b577f4",
+    "opus-v2.metadata.json": "9b6d7a44578fa6be9cc341a045db0c73fc7439ef7e0ee5a8aa99e66250493cc8",
+    "opus-v3.metadata.json": "678ed800aae399d627a19e9802aeb7109bf51ee539163263c2fec06aba4efbc3"
+  },
+  "verification_record_sha256": {
+    "verification/baseline-verification.json": "700dddb0a9efab01a0524a51736fecd457ed81e689926c842fa2de6838f1e1d6",
+    "verification/rebased-delete-verification.json": "f370ba2c9c0b9d6695cf2701f97dbd774a336f833d474992f2c390e67d9cbf58",
+    "verification/rebased-verification.json": "4d9ad5688d45cba15fe9632590854a48e6fca048f5f3556d5edf9a4b1997d9ca"
+  },
+  "go_version": "go version go1.27.1 darwin/arm64",
+  "GOMAXPROCS": "4",
+  "verification_source_unchanged": true,
+  "delivery_note": "The follow-up commit records verification documents only; all production and test files match verified_source_commit."
+}
@@ -0,0 +1,5 @@
+You are the independent Opus reviewer for SILO R6. Read AGENTS.md first. Review only; do not edit files. We need real independent technical scrutiny, not a ceremonial approval.
+
+Source commit: 9ebe81c1b3611f9cc73e676b5b741c2be62c467a. Plan file: docs/investigations/r6/plan-v1.md. Plan SHA256: bcd023e2b00ad3dc709baa738bb02551d47aeebb49879b0f76f2789f4c4dff8b. Read that exact file in full and inspect the referenced current source and tests. PR184 raw patch and fresh baseline probes are in /Users/vonng/tmp/silo-r6-20260915-aa3f/ (read pr184.diff, review_probe_test.go, baseline.log if available). Its code direction is useful but its claims are not accepted evidence. Focus on every exit of replicateDeleteToTarget and replicateDelete, persisted queueMRFHeal with MethodNotAllowed ObjectInfo, preserving statuses, resync accounting and actual wire behavior on retries.
+
+Critically verify whether the minimal proposed code could restore an already removed marker, whether retry budgets and multi-target status remain safe within the explicit bounded scope. Explain any disagreement with precise code evidence and a concrete minimal correction. Return a verdict GO, GO_WITH_NONBLOCKING_NOTES, or REVISE, explicitly for plan v1 hash bcd023e2b00ad3dc709baa738bb02551d47aeebb49879b0f76f2789f4c4dff8b. List blocking findings separately from nonblocking suggestions. If there are no blockers, explicitly state that consensus on this plan is technically acceptable, while implementation still requires tests. Do not claim to have run anything.
@@ -0,0 +1,3 @@
+Review the revised R6 plan, read-only. The exact source remains 9ebe81c1b3611f9cc73e676b5b741c2be62c467a. Read AGENTS.md, docs/investigations/r6/opus-v1-review.md, docs/investigations/r6/decisions-v2.md, and docs/investigations/r6/plan-v2.md (SHA256 dae51753a3ab4b2ea98b85e720144338fdf52541ca6daf968c7dac5ce564d8c3). Focus on resolving your B1 and coupled exits, and verify the amended retry queue-full site. We accepted your disk-preservation correction; the previous inference from an empty per-target return was too strong. No production implementation has started. Source and temporary probes remain available. Real storage fixtures now execute with the repository capacity adapter (only DiskInfo capacity changes); baseline-mrf.log and pr184-mrf.log have the evidence.
+
+Perform a targeted delta review of v2, inspect source as needed; do not re-review unrelated systems or attempt to write a file. Say GO, GO_WITH_NONBLOCKING_NOTES, or REVISE explicitly for plan-v2.md hash dae51753a3ab4b2ea98b85e720144338fdf52541ca6daf968c7dac5ce564d8c3, list any blockers, and if acceptable explicitly state consensus on the exact plan. Tests are future obligations, not completed acceptance.
@@ -0,0 +1,5 @@
+Targeted R6 incremental review, read only, no file writes. Real v2 consensus was GO; v2 implementation was then authorized and implemented. We found an executable counterexample to part of both our empty-composite proofs. Read docs/investigations/r6/plan-v3.md (SHA256 dc9a67fc91b3113fa35218a2f903455807430cc4daf9c78a88d0be6b8fc27058) especially the final incremental section, and /Users/vonng/tmp/silo-r6-20260915-aa3f/v2-unrecorded-purge.log. Inspect the current implementation and the new TestReplicationMRFMarkerRecovery/unrecorded-purge test. Source identity: baseline 9ebe81c1 plus implementation-v2.diff in that evidence directory; v3's three-field correction is NOT applied yet.
+
+The regex requires a character but permits a semicolon: two empty entries parse into a nonempty fake status. Usual purge metadata sets FileInfo.Deleted=false and masks it, but a task ahead of source purge metadata reproduces real creation-block overwrite with two targets. Proposed minimal delta is ONLY in outer replicateDelete after getReplicationState: if isPurge then drs.ReplicationStatusInternal="", drs.Targets=nil, drs.ReplicaStatus="". This makes CompositeReplicationStatus truly empty, preserves disk creation/replica blocks, retains purge/reset metadata, and avoids changing shared parsing or merging.
+
+Please independently verify the counterexample, field selection, whether the proposal introduces any loss or leak, and whether it suffices. Focus this review on the delta and its interactions rather than restarting unrelated exploration. Return explicit GO/GO_WITH_NONBLOCKING_NOTES/REVISE for plan-v3.md hash dc9a67fc91b3113fa35218a2f903455807430cc4daf9c78a88d0be6b8fc27058; list blockers and state exact-plan consensus if acceptable. Do not claim tests ran or that the normal producer necessarily emits the special setup. The reviewers' earlier multi-target regex proof was too strong; revise the conclusion candidly. Other scope limits remain explicit.
@@ -0,0 +1,78 @@
+I'll start by reading AGENTS.md and the plan file, then dig into the actual source.
+
+Let me locate the core source files and the evidence directory.
+
+I've verified the plan against the actual source. Writing up the review now.
+
+The `Write` tool is disabled in this session, so I can't create the plan file — the review is below in full.
+
+---
+
+# Independent review — SILO R6 `plan-v1.md`
+
+**Plan hash reviewed:** `bcd023e2b00ad3dc709baa738bb02551d47aeebb49879b0f76f2789f4c4dff8b`
+**Source:** `9ebe81c1b3611f9cc73e676b5b741c2be62c467a`
+**I did not run anything.** All findings come from reading the source, the existing tests, PR #184's diff/prose, and the supplied `baseline.log` (read, not produced by me).
+
+## Verdict: **REVISE**
+
+One blocking finding. The classification rule, the canonical-wire choice, the MRF 405 work, and the retry-budget work are technically correct and better grounded than PR #184. One explicitly prescribed detail in §A causes a silent regression on the *canonical* purge shape — the shape every live producer emits — and §C would not catch it. The correction is small and stays inside the plan's bounded scope.
+
+---
+
+## Blocking
+
+### B1 — Pinning `rinfo.ReplicationStatus = rinfo.PrevReplicationStatus` for purges makes the persisted marker creation-status block get rewritten from the fan-out subset
+
+§A prescribes this "on every exit" while also forbidding changes to `getReplicationState` merging. Together that is a regression, not preservation.
+
+1. `bucket-replication-utils.go:392-399` — `targetState()` never sets `ReplicationStatus`, so a canonical purge returns `""` today.
+2. `bucket-replication-utils.go:92-101` — `ReplicationStatusInternal()` rebuilds `"arn=STATUS;"` **only from `rinfos.Targets`**, i.e. only fanned-out targets.
+3. `bucket-replication.go:508-543` — fan-out skips `!Replicate`, non-matching `dobj.TargetArn`, and nil clients. `TargetArn` is really set by `queueReplicateDeletesWrapper` (`:2400-2409`).
+4. `bucket-replication-utils.go:410-412` → `drs`, passed as `DeleteReplication` at `bucket-replication.go:572-582`.
+5. `erasure-object.go:2163-2177` → `xl-storage-format-v2.go:1438-1446` — for a `DeleteType` version, **if `fi.DeleteMarkerReplicationStatus()` is non-empty**, `MetaSys[ReplicationStatus]` and `MetaSys[ReplicationTimestamp]` are overwritten.
+
+Today that guard never fires for a canonical purge: the string is `"arn1=;"`, `replicationStatusesMap` doesn't match it (`:428-439`), composite over the empty map is `""` (`:455-459`) — so the on-disk creation block is left **untouched**, which preserves it perfectly including non-attempted targets. Under the plan it becomes non-empty and is rewritten:
+
+- **Status loss:** `"arn1=COMPLETED;arn2=COMPLETED;"` with a fan-out covering only `arn2` persists `"arn2=COMPLETED;"` — `arn1` silently dropped. That is the exact failure the plan exists to fix, newly introduced on the main shape.
+- **Zero timestamp:** `rs.ReplicationTimeStamp = rinfos.ReplicationTimeStamp` (`:413`) is never assigned in `replicateDelete`; it's only rescued by `bucket-replication.go:568-570` when the composite *changes*. A repeated FAILED→FAILED purge writes `0001-01-01T00:00:00Z`.
+- **Empty ReplicaStatus:** under a legacy `RoleArn` config the composite can be `REPLICA` (`bucket-replication-utils.go:497-503`), taking `xl-storage-format-v2.go:1398-1400`, which writes `ReplicaStatus` — never populated by `ObjectInfo.ReplicationState()` (`:569-587`).
+
+Only delete-**marker** versions are affected; `ObjectType` versions only touch `VersionPurgeStatusKey` (`xl-storage-format-v2.go:1465-1476`).
+
+**Minimal correction (strictly smaller than the plan):** keep the classification and every exit fix, but for purges **leave `rinfo.ReplicationStatus` at its zero value** rather than pinning it. That is what the canonical path already does, and it preserves the on-disk block byte-for-byte including non-attempted targets, with no change to `getReplicationState`. Consequences that then become mandatory, not optional:
+
+- purge exits write only `VersionPurgeStatus` — never `Failed`, `Completed`, or `PrevReplicationStatus`;
+- the resync defer (`:618-622`) must be gated on the operation's own success. Under the plan as written, pinning `Completed` would stamp the reset marker for a **failed** purge on any marker whose creation was COMPLETED — the two changes are coupled and cannot land separately;
+- the stats gate at `:556` must be replaced by the per-target operation-status comparison §A already calls for, otherwise purges stop being reported at all.
+
+Add a partial-fan-out test: two ARNs persisted, one excluded from fan-out, failed purge → marker metadata unchanged. §C item 5 fans out to *both* targets and cannot detect this.
+
+---
+
+## Nonblocking
+
+1. **The wire version ID is load-bearing.** For the legacy shape `dobj.VersionID` is empty, so the implementation must keep the existing `versionID` fallback (`bucket-replication.go:609-612`). A `RemoveObject` with empty `VersionID` against a versioned target **creates a new marker** (`erasure-object.go:2126-2149`) — the exact resurrection being fixed. Make §C1 assert the outgoing `versionId` and `x-minio-source-deletemarker` explicitly.
+2. **Retry increment must cover all three delete-path MRF sites:** `:487` (lock), `:565` (aggregate failure), `:2427` (queue full). §B names only the first two; missing `:2427` leaves an unbounded loop once marker MRF is live. Mirror `ri.RetryCount++` at `:1310`.
+3. **Stats will move.** `COMPLETE`→`COMPLETED` makes `ReplicationStats.Update` reach its `Completed` case for Heal/ExistingObject deletes (`bucket-replication-stats.go:184-201`, `replication.go:139-144`). Today `"COMPLETE" != "COMPLETED"` so nothing is recorded. Assert expected counter deltas rather than discovering them.
+4. **§B's identity gate excludes null-version markers by construction** — `GetObjectInfo` returns `ObjectNotFound`, not 405, when `VersionID == ""` (`erasure-object.go:996-999`), and `ToObjectInfo` leaves `VersionID` empty when `versioned` is false (`erasure-metadata.go:120-123`). No regression, but document it instead of implying MRF healing is complete.
+5. **Legacy-shape scope.** I found no producer of that shape on this baseline: `object-handlers.go:3225-3228`, `bucket-handlers.go:565-570`, `bucket-replication.go:3323-3327`/`:3775-3779` are mutually exclusive, and `erasure-object.go:1752-1766` only sets `DeleteMarkerVersionID` when `VersionID == ""`. `DeletedObjectReplicationInfo` isn't serialized, so it can't survive a restart. §A's legacy handling is upgrade/robustness work; the live value of R6 is mostly §B. Say so in the PR text so the fork doesn't inherit #184's overclaiming.
+6. **§C item 3 is testable but fiddly.** `globalLocalDrivesMap` is populated by `newErasureServerPools` (`erasure-server-pool.go:174-181`), so save/load works — but `loadMRF` **deletes the file after reading** (`:4013-4015`) and `queueMRFHeal` dispatches a detached goroutine with a 1s per-entry context (`:4067-4081`). Re-persist between rounds and synchronize, don't sleep.
+7. **Confirm the fixtures run.** The supplied `baseline.log` shows both `TestReplicateDeleteMarkerPurge` subtests aborting at `replication-delete-marker_test.go:121` with "Storage reached its minimum free drive threshold" — an environment failure. §C items 2, 3, 5 all depend on those fixtures.
+
+---
+
+## Independently confirmed as correct in the plan
+
+- **Observation 1 holds at every exit:** `:624` (early-return without sending), `:645-649`/`:702-706`/`:712-716` (field selected on `dobj.VersionID`), `:684-688` (HEAD-not-ready overwrites creation status unconditionally), `:628` (completed-purge early-out only for non-empty `VersionID`), `:618-622` (resync stamp keyed on `ReplicationStatus`). The supplied probe log agrees.
+- **Observation 2 is a real regression in PR #184.** `replicateDelete` selects on `dobj.VersionID != ""` (`:549-552`), so with only the target-side fix a failed legacy purge aggregates to `COMPLETED`, emits `ObjectReplicationComplete`, and **skips `queueMRFSave`** (`:563-566`) — worse than baseline.
+- **Task-level classification is required; #184's per-target `isDMPurge` is wrong.** `VersionPurgeStatus()` needs `completed == len(ri.Targets)` (`bucket-replication-utils.go:122-139`); a target classified as a creation never sets the purge field, so the composite can never reach COMPLETE. The task-level rule is also safe here — no current producer emits a creation with a non-empty composite purge status.
+- **The canonical-wire choice really does fix resurrection; #184 does not.** With `ReplicationDeleteMarker=true` and an absent version the receiver re-creates the marker (`xl-storage.go:1346-1349`; `xl-storage-format-v2.go:1517-1520`). With `false`, the receiver returns VersionNotFound (`erasure-object.go:2013-2027`) and the handler answers 204 (`object-handlers.go:3171-3192`). Scope it honestly: this only changes *legacy-shaped* purges (canonical already sends `false`), and does nothing for a delayed creation after a purge — correctly filed as separate.
+- **§B's 405 premise is exact:** `erasure-object.go:996-1002` returns a populated `ObjectInfo` with `toObjectErr(errMethodNotAllowed,…)` → `MethodNotAllowed{}` (`object-api-errors.go:96-102`), preserved multi-pool too (`erasure-server-pool.go:1063-1077`).
+- **§B's retry gap is real:** `ToMRFEntry()` (`:1927-1937`) never sets `RetryCount`, so the `> mrfRetryLimit` drop (`:3883-3887`) can never fire for deletes. No msgp code exists for the type, so the field is genuinely schema-free.
+- **Resync accounting already handles both shapes** — `resyncTargetSucceeded` (`:3154-3162`) keys on `roi.VersionPurgeStatus`. The plan correctly leaves it alone.
+- **The pushback on #184's permanence/topology prose is correct.** Canonical purge retries are not short-circuited on this baseline (`:624` requires `VersionID == ""`; `:628` exits only on `VersionPurgeComplete`). #184's Bugs 1 and 2 as narrated are legacy-shape-only.
+
+---
+
+Because B1 is a blocker, I am not stating consensus on this exact hash. Resolve B1 (and the coupled resync-defer/stats-gate items it forces) and the plan becomes technically acceptable in my judgement — implementation would still require the tests in §C plus the partial-fan-out regression above.
@@ -0,0 +1,23 @@
+{
+  "source_commit": "9ebe81c1b3611f9cc73e676b5b741c2be62c467a",
+  "requested_model": "claude-opus-5",
+  "requested_effort": "max",
+  "cli_version": "2.1.270",
+  "plan": "plan-v1.md",
+  "plan_sha256": "bcd023e2b00ad3dc709baa738bb02551d47aeebb49879b0f76f2789f4c4dff8b",
+  "assistant_models": [
+    "claude-opus-5"
+  ],
+  "raw_path": "/Users/vonng/tmp/silo-r6-20260915-aa3f/opus-v1.jsonl",
+  "raw_sha256": "16f1954b213b5813a72a8db6d960d7933e1065c63e9ae2d6f139d0cff881011f",
+  "command": "claude --print --model claude-opus-5 --effort max --safe-mode --permission-mode plan --tools Read,Grep,Glob --strict-mcp-config --no-session-persistence --add-dir /Users/vonng/tmp/silo-r6-20260915-aa3f --output-format stream-json --verbose",
+  "auxiliary_usage_models": [
+    "claude-haiku-4-5-20251001",
+    "claude-opus-5"
+  ],
+  "subtype": "success",
+  "is_error": false,
+  "session_id": "927a163e-c14f-4366-b1bc-dbb363fbe793",
+  "duration_ms": 357292,
+  "num_turns": 61
+}
@@ -0,0 +1,86 @@
+I'll start by reading the required documents and verifying the plan hash.
+
+Now let me verify the plan hash and inspect the source claims.
+
+I read AGENTS.md, opus-v1-review.md, decisions-v2.md, and plan-v2.md, then re-checked every claim v2 changed against the source at `9ebe81c1b`. I ran nothing; findings are source reading plus the supplied logs.
+
+One honesty note up front: **no shell tool is available in this session, so I could not compute the SHA256 myself.** My verdict is on the exact content I read at `docs/investigations/r6/plan-v2.md` — 59 lines, opening `# R6 plan v2 — marker purge operation and MRF recovery`, dated 2026-09-15, closing with the "v2 changes from Opus v1" section that lists B1/N1–N7 dispositions. If that is `dae51753a3ab4b2ea98b85e720144338fdf52541ca6daf968c7dac5ce564d8c3`, the verdict below attaches to that hash.
+
+# Verdict: GO_WITH_NONBLOCKING_NOTES
+
+**Blockers: none.** B1 is resolved, and resolved by the correct mechanism rather than by wording.
+
+---
+
+## B1 and the coupled exits — resolved, mechanism verified end-to-end
+
+§A now says purges leave `rinfo.ReplicationStatus` empty on every exit. I traced the preservation chain to make sure that is actually load-bearing and not just an absence:
+
+1. `replicatedInfos.ReplicationStatusInternal()` (`cmd/bucket-replication-utils.go:92-101`) emits `"arn1=;"` — non-empty, so it does reach `ReplicationState`.
+2. `replicationStatusesMap` (`:428-439`) uses `replStatusRegex` (`:168`), whose second group `([^,].*?)` requires ≥1 char before `;`. `"arn1=;"` does not match → **empty `Targets` map**.
+3. `CompositeReplicationStatus()` (`:356-372`) therefore takes the `default:` branch → `getCompositeReplicationStatus(empty)` → `""`; the `ReplicaTimeStamp` fall-through at `:366-371` also returns `""` because `replStatus == Completed` is false. So the composite is `""` under every sub-case.
+4. `xl-storage-format-v2.go:1438` gates the `DeleteType` rewrite on `!fi.DeleteMarkerReplicationStatus().Empty()` → **guard never fires** → `MetaSys[ReplicationStatus]`, `MetaSys[ReplicationTimestamp]` and the Replica pair at `:1441-1442` are left byte-for-byte intact, including ARNs excluded from fan-out. `updateVersion` is still true via `:1390`, so `MetaSys[VersionPurgeStatusKey]` at `:1448-1449` is written as intended.
+
+All three consequences I said were mandatory and non-separable are present:
+
+| Coupled item | v2 |
+|---|---|
+| Purge exits write only `VersionPurgeStatus` | §A, explicit, "on every exit"; `PrevReplicationStatus` retained for inspection only — harmless, `targetState()` sets it and nothing persists it |
+| Resync defer gated on the operation's own success | §A "Do not stamp the current resync reset for a failed purge"; §C1 asserts the reset marker |
+| `:556` stats gate replaced by per-target operation-status comparison | §A "Feed per-target old/new operation status into stats rather than selecting changes from the unrelated creation status" |
+| Partial-fan-out regression test | §C5, with two creation ARNs, a non-zero timestamp, and fan-out restricted to one ARN |
+
+The zero-timestamp and `ReplicaStatus` sub-findings from v1 are dissolved rather than patched: with the composite empty, `:1444-1445` is never reached, so `drs.ReplicationTimeStamp` (set at `bucket-replication.go:568-570`) cannot land on disk for a purge at all.
+
+I also checked the downstream consumer the change could have silently flipped: `resyncTargetSucceeded` (`bucket-replication.go:3154-3162`) keys the purge branch on `roi.VersionPurgeStatus` and reads `t.VersionPurgeStatus`, never `t.ReplicationStatus`. Leaving `ReplicationStatus` empty makes resync accounting strictly more correct for the old shape (today a resynced old-shape purge sets `ReplicationStatus = Completed` at `:713`). §A's "leave it alone" is right.
+
+## Amended retry queue-full site — correct
+
+`cmd/bucket-replication.go:2411-2448`, `queueReplicaDeleteTask`, `default:` branch of the select at `:2426-2427` → `p.queueMRFSave(doi.ToMRFEntry())`. §B names it exactly ("queueReplicaDeleteTask queue-full fallback"). I grepped every `queueMRFSave(` call: the delete-path sites are precisely `:487` (lock), `:565` (aggregate failure), `:2427` (queue-full) — three, no more. `:1206`, `:1311`, `:2339`, `:2370` are object-path.
+
+The supporting claims hold too: `MRFReplicateEntry.RetryCount` already exists with msgp tag `rc` (`bucket-replication-utils.go:792`), so no format change; `DeletedObjectReplicationInfo.ToMRFEntry()` (`:1927-1937`) sets only `Bucket`/`Object`/`versionID`; `versionID` is unexported but survives as the map key (`persistMRF` `:3870`, read back at `:4068`); the `> mrfRetryLimit` drop at `:3883-3887` is therefore currently unreachable for deletes; and `DeletedObjectReplicationInfo` has no generated msgp code, so the new field is genuinely schema-free. The gap's exact location is `queueReplicationHeal:3762` setting `roi.RetryCount` while `dv` at `:3781-3793` drops it — which is what §B closes.
+
+## N7 evidence — checks out
+
+`baseline-mrf.log` shows `TestReplicateDeleteMarkerPurge` both subtests **PASS**; the "Storage reached its minimum free drive threshold" abort from v1 is gone, so §C items 2/3/5/6 have a working fixture. The logs also independently corroborate two plan premises on real storage: `err=Method not allowed` on the source marker lookup (§B's 405 premise), and `legacy=true … MRF=0` on both baseline and PR #184 (observation 2, and #184's residual gap). Your retraction is right, and I'd add that the mechanism is visible: `replicatedInfos.ReplicationStatus()` (`bucket-replication-utils.go:103-119`) counts *every* target including empty-status ones, so `creation=PENDING` for a canonical purge is an artifact of that aggregate, not disk state. The retained logs still carry the old "failure stored in incorrect status field" assertion text on the canonical rows — worth a pointer to decisions-v2's retraction beside them so a later reader doesn't re-derive the wrong conclusion.
+
+---
+
+## Non-blocking notes
+
+1. **Audit `Status` string changes on the live canonical path.** §A folds audit into the COMPLETE→COMPLETED mapping. The audit defer at `bucket-replication.go:434-444` logs `Status: string(replicationStatus)`, so every successful canonical versioned-delete replication goes from `COMPLETE` to `COMPLETED`. That is a user-visible change on the *live* path, not the legacy one. Keep it — `CompletedLegacy` is documented as an error at `internal/bucket/replication/datatypes.go:35-36` — but assert the audit string in §C, reuse `replication.CompletedLegacy` rather than a `"COMPLETE"` literal, and mention it in the PR text.
+2. **The stats delta is wider than §C5's Heal/ExistingObject framing.** The `Completed` case gate is right (`bucket-replication-stats.go:189-192` requires `IsDataReplication()`, which excludes the unset OpType on handler-originated deletes — `replication.go:139-145`). But replacing the `:556` gate also changes *which* purges reach `Update`: today `""` vs `COMPLETED` makes that gate fire for nearly every purge of a previously-replicated version, and old-shape purges currently record a spurious `Pending` (aggregate `Pending`, prev `COMPLETED`). Assert that spurious `Pending` disappears too. Note `ri.Size` is never set in `replicateDeleteToTarget`, so `Completed` deltas are count-only, zero bytes.
+3. **Make the `ResetStatusesMap` nil-guard unconditional** instead of contingent on tests exposing it (plan line 51). `getReplicationState:419-422` writes into `prevState.ResetStatusesMap` unguarded; `ObjectToDelete.ReplicationState()` (`:590-600`) leaves it nil, unlike `ObjectInfo.ReplicationState()` (`:576`). Today it is unreachable only because the resync defer requires `ReplicationStatus == Completed`, which purges never reach — and §A re-gates exactly that defer. I traced the live producers: the sole `ExistingObjectReplicationType` delete is `:3329-3342`, fed by `getHealReplicateObjectInfo` → `oi.ReplicationState()` → non-nil, so this is robustness and test-fixture safety, not a live panic. Two lines; just do it.
+4. **Pin the already-COMPLETE purge under ExistingObject resync in §C1.** The purge early-out at `:628` has no `OpType != ExistingObjectReplicationType` exclusion, unlike the creation early-out at `:624`. Routing old-shape purges through it means a resync of an already-COMPLETE old-shape purge now short-circuits where today it re-sends. That matches canonical behaviour and is probably intended, but §C1's "resync success/failure" row currently leaves the implementer free to pick either.
+5. **Scope "Preserve actual target failure in Err, including offline error where appropriate."** The offline exit (`:631-651`) sets no `Err` today, and `Err` flows into `replStat.set(...)` → `srUpdate` → site-replication stats. Say whether creations also start carrying an offline `Err`, or restrict it to purges; otherwise §C6's offline row has no fixed expectation.
+6. **Leave `getReplicationState`'s third parameter alone.** `vID` (`bucket-replication-utils.go:402`) is entirely unused in the body. Since §A re-plumbs shape classification, someone will be tempted to wire it up; the empty-composite preservation depends on that function staying shape-agnostic.
+7. **§B identity gate: key on `versionID` + `DeleteMarker` + non-zero `ModTime`.** `queueMRFHeal` calls `GetObjectInfo` with `ObjectOptions{VersionID: vID}` and no `Versioned`, so `ToObjectInfo` (`erasure-metadata.go:118-123`) returns `fi.VersionID` verbatim — the gate works. Bucket/object equality is trivially satisfied (they are the request arguments); the one component that can be perturbed is a strict `oi.Name == e.Object` against `decodeDirObject` (`cmd/utils.go:899-904`) for directory objects. `erasure-server-pool.go:1063-1077` does return the populated `oi` with the error upward, so the gate has real data to inspect.
+8. **RetryCount type.** `ReplicateObjectInfo.RetryCount` is `uint32` (`:3762`), `MRFReplicateEntry.RetryCount` is `int` (`:792`), `QueueReplicationHeal` takes `int`. Pick one for the new delete-task field and keep conversions in one place.
+9. **State the purge-subset loss as pre-existing, not merely excluded.** The asymmetry §C5 carves out is structural: creation status survives partial fan-out *because* the composite is empty (`:1438`), while `VersionPurgeStatusInternal()` is non-empty and unconditionally rewrites `MetaSys[VersionPurgeStatusKey]` from the fan-out subset (`:1448-1449`). Canonical purges already lose excluded-ARN purge status today, so R6 neither causes nor fixes it. Say that, or a reader will assume both were repaired.
+10. **§C3 flush mechanics.** `persistMRF` (`:3866-3874`) only writes to disk on the 5-minute timer, ctx cancel, or 1M entries; the re-queued entry lands in an in-memory map first. N6's "persist each failed entry again" covers it, but make explicit that the test drives `saveMRFEntries` directly rather than waiting on the timer — and that `loadMRF` deletes the file after reading (`:4013-4015`), so each round needs a fresh write.
+
+---
+
+## Consensus
+
+I state consensus on **`docs/investigations/r6/plan-v2.md` exactly as reviewed here** (hash `dae51753a3ab4b2ea98b85e720144338fdf52541ca6daf968c7dac5ce564d8c3` as supplied; content verified, digest not independently computed for lack of a shell tool). The classification rule, the all-exits treatment, the canonical-wire choice, the empty-creation-status preservation mechanism, the valid-405 gate, the three-site retry budget, and the §C matrix are technically correct against `9ebe81c1b`, and the scope limits in the "Existing state, compatibility, and delivery" section are accurate rather than overclaimed. The ten notes above are refinements and assertions to add, not conditions on this agreement — none of them requires another review round or a new hash.
+
+Tests in §C remain future obligations. Nothing here asserts they pass; the only executed evidence I relied on is the supplied baseline/PR logs, which establish fixture viability and the two defect premises, not acceptance.
+
+The review above is complete and stands as delivered. Summarizing the required outputs:
+
+**Verdict for `docs/investigations/r6/plan-v2.md`, hash `dae51753a3ab4b2ea98b85e720144338fdf52541ca6daf968c7dac5ce564d8c3`: GO_WITH_NONBLOCKING_NOTES**
+
+**Blockers: none.**
+
+**Consensus:** I state consensus on the exact plan as reviewed. The one caveat is procedural, not substantive: no shell tool is available in this session, so I verified the plan's *content* (59 lines, opening `# R6 plan v2 — marker purge operation and MRF recovery`, closing with the B1/N1–N7 disposition list) but could not independently compute its digest. Consensus attaches to that content.
+
+What I resolved this round:
+- **B1** — accepted resolution, and I confirmed the mechanism is real rather than merely absent: `"arn1=;"` fails `replStatusRegex`, so `Targets` is empty, so `CompositeReplicationStatus()` returns `""` under every sub-case including the `ReplicaTimeStamp` fall-through, so the `xl-storage-format-v2.go:1438` guard never fires and the on-disk creation block survives partial fan-out intact — while `updateVersion` still writes `VersionPurgeStatusKey`.
+- **Coupled exits** — all three present (purge-only status writes; resync defer gated on the operation's own success; `:556` gate replaced by per-target operation status), plus the §C5 partial-fan-out test. I also checked the one consumer that could have flipped silently, `resyncTargetSucceeded:3154-3162`, and it keys on `VersionPurgeStatus` — so the change makes resync accounting strictly more correct.
+- **Queue-full retry site** — `queueReplicaDeleteTask`, `default:` branch, `bucket-replication.go:2427`; the delete-path `queueMRFSave` sites are exactly `:487`, `:565`, `:2427`, and the `RetryCount` disk field already exists with msgp tag `rc`.
+- **N7** — the fixture-threshold failure is gone; `TestReplicateDeleteMarkerPurge` passes on baseline, and the logs corroborate the 405 premise and the `legacy=true … MRF=0` gap on both baseline and #184.
+
+The ten non-blocking notes are in my response; the three worth acting on before you branch are the audit-string change on the live canonical path (note 1), the wider-than-stated stats delta (note 2), and making the `ResetStatusesMap` nil-guard unconditional (note 3). None requires another review round or a new hash.
+
+Tests in §C remain future obligations — nothing here asserts they pass. I made no edits and wrote no files.
@@ -0,0 +1,23 @@
+{
+  "source_commit": "9ebe81c1b3611f9cc73e676b5b741c2be62c467a",
+  "requested_model": "claude-opus-5",
+  "requested_effort": "max",
+  "cli_version": "2.1.270",
+  "plan": "plan-v2.md",
+  "plan_sha256": "dae51753a3ab4b2ea98b85e720144338fdf52541ca6daf968c7dac5ce564d8c3",
+  "assistant_models": [
+    "claude-opus-5"
+  ],
+  "raw_path": "/Users/vonng/tmp/silo-r6-20260915-aa3f/opus-v2.jsonl",
+  "raw_sha256": "aa4d04931875e82ae850a8fa2b875c094f36625784c8c090781f9a0273d20871",
+  "command": "claude --print --model claude-opus-5 --effort max --safe-mode --permission-mode plan --tools Read,Grep,Glob --strict-mcp-config --no-session-persistence --add-dir /Users/vonng/tmp/silo-r6-20260915-aa3f --output-format stream-json --verbose",
+  "auxiliary_usage_models": [
+    "claude-haiku-4-5-20251001",
+    "claude-opus-5"
+  ],
+  "subtype": "success",
+  "is_error": false,
+  "session_id": "c6dfdf82-d542-47a1-8e69-a48753d61b12",
+  "duration_ms": 219946,
+  "num_turns": 41
+}
@@ -0,0 +1,77 @@
+I'll start by reading the key evidence documents and the current implementation state.
+
+I have everything I need. Let me verify one last interaction — whether the delta is pinned by any existing test — and then write the review.
+
+Write is disabled in this session (consistent with your read-only constraint), so the review is delivered here in full.
+
+# Verdict: **GO_WITH_NONBLOCKING_NOTES** — `plan-v3.md`
+
+**Blockers: none.**
+
+Digest caveat: no shell tool in this session, so I could not compute SHA256 and cannot attest `dc9a67fc91b3113fa35218a2f903455807430cc4daf9c78a88d0be6b8fc27058`. Consensus attaches to the content I read — 70 lines, opening `# R6 plan v3 — marker purge operation and MRF recovery`, closing `...including the proof now corrected by the executable counterexample.` — the same procedural caveat the v2 reviewer recorded. I ran no tests; `v2-unrecorded-purge.log` is treated as reported evidence, not as my own execution.
+
+Source reviewed: worktree = `9ebe81c1` + `implementation-v2.diff`, v3 delta **not** applied.
+
+---
+
+## 1. Counterexample verified — and I am withdrawing the general form of the earlier proof
+
+The v2 consensus rested on: empty per-target status ⇒ `"arn=;"` ⇒ no regex match ⇒ empty `Targets` ⇒ empty composite ⇒ guard at `cmd/xl-storage-format-v2.go:1438` never fires. **That holds only for |targets| ≤ 1. It is false for ≥ 2.** The reviewers' multi-target regex proof was too strong; the executable counterexample is correct.
+
+Trace against `replStatusRegex = ([^=].*?)=([^,].*?);` (`cmd/bucket-replication-utils.go:168`), input `arn1=;arn2=;`:
+- group 1 lazily reaches the first `=` → `arn1`
+- group 2's `[^,]` **accepts `;`** (the class excludes comma, not semicolon), then `.*?` runs to the next `;` → `;arn2=`
+- one match spans the whole string → `{arn1: ";arn2="}`
+
+Then `CompositeReplicationStatus` (`:356-379`): non-empty internal, not a legacy literal → `default` → `getCompositeReplicationStatus` sees one bogus entry → **`Pending`**. The `ReplicaTimeStamp` fall-through at `:366-371` cannot rescue it (it only returns `ReplicaStatus` when `replStatus == Completed`). Generalizes: N=1 → `""`; every N ≥ 2 → `Pending`, always via a `;`-prefixed value, so it can never accidentally land on a real status.
+
+**Why the ordinary multi-target tests passed** — plan §v3 is right, with one mechanism refinement: the masking is not in the guard, it is in `FileInfo.DeleteMarkerReplicationStatus()` (`cmd/erasure-metadata.go:670-675`), which returns `""` whenever `!fi.Deleted`, regardless of the composite. `erasureObjects.DeleteObject` sets `deleteMarker=false` when `versionFound && !goi.VersionPurgeStatus.Empty()` (`cmd/erasure-object.go:2100-2101`) — the normal state after the handler's PENDING write. A **second independent masking condition** sits at `:2102` (`else if !goi.DeleteMarker`), so purges of ordinary object versions are never exposed: the hole is confined to delete-marker versions whose on-disk purge status is absent.
+
+Unrecorded path: disk marker has creation metadata only → `deleteMarker` stays `opts.Versioned=true` → `fi.Deleted=true` → `DeleteMarkerReplicationStatus()` = bogus `Pending` → guard at `:1438` fires → `default` branch rewrites `ReplicationStatus` = `arn1=;arn2=;` and `ReplicationTimestamp` = `UTCNow()` (supplied by `:576`, since FAILED ≠ PENDING). Exactly the recorded log: statuses emptied, stamp jumping `15:06:15Z` → `16:06:15.612037Z`.
+
+The fixture is sound: the recreate at `replication-delete-mrf_test.go:258` genuinely removes the marker (`updateVersion=false` → removal branch at `:1457`), the reseed at `:261-264` writes a creation-only block, and `deletion` — captured from the real signed handler DELETE at `:249` — still carries PENDING purge state. `before` is sampled at `:304`, after the reseed.
+
+**Scoping, unweakened:** the normal producer does not demonstrably race. `DeleteObjectHandler` enqueues only after a successful write and derives the task from the returned `objInfo` (`cmd/object-handlers.go:3164, 3222-3242`); `queueReplicationHeal` derives it from current disk state (`cmd/bucket-replication.go:3808-3821`). Reaching the unrecorded shape needs disk/task divergence — e.g. a partial-quorum PENDING write later healed back from a stale shard while the in-memory task survives. Narrow, not impossible, unproven. Two facts bound the blast radius: the damage is **one-shot** (the same failed write records the purge status, masking every later round), and it is erased if the purge ever completes. It remains real metadata corruption while a marker is stuck — garbage per-target creation statuses plus a lost creation timestamp.
+
+## 2. Field selection — correct, with one candid downgrade
+
+| Field | Assessment |
+|---|---|
+| `ReplicationStatusInternal = ""` | **Load-bearing.** Direct cause; forces the composite to case 3. |
+| `Targets = nil` | **Consistency hygiene.** The composite switches on the string, so it changes nothing today; it prevents an internally inconsistent state (empty string, populated map) misleading a future reader. Keep. |
+| `ReplicaStatus = ""` | **Defensive, not load-bearing today.** The fallback at `:374-375` is real, but no production producer populates it: `ObjectInfo.ReplicationState()` (`:572-590`) and `ObjectToDelete.ReplicationState()` (`:593-602`) both omit the replica fields, and every delete-task construction site (`bucket-replication.go:2678, 3361, 3813`, `object-handlers.go:3237`, `erasure-object.go:1715, 1758, 1764`) routes through one of them. Keep it — free, and it closes the documented fallback — but it does not repair anything observed. |
+
+`isPurge` is the right gate: one value computed pre-fan-out at `:428`, identical to the one `replicateDeleteToTarget` uses at `:616`. Creations untouched.
+
+## 3. Loss / leak — none found
+
+- **Creation + replica blocks preserved.** Both write sites (`:1396` ventry, `:1438` in-place) sit behind the same now-dead guard, and `:1430-1453` mutates the existing `ver.DeleteMarker.MetaSys` by key, never clearing it. A no-update payload, exactly as the plan says.
+- **Purge block / reset map still written** (`:1448-1453`); `updateVersion` unchanged (`:1380` diverts on the non-empty purge status, `:1390` sets it for any non-COMPLETE purge).
+- **Successful purge:** composite COMPLETE → `updateVersion=false` → version removed at `:1457`; `:1458`/`:1460` both stay false. Unchanged.
+- **ventry path (`:1395-1411`, added at `:1506`) unreachable for purges:** reaching `:1506` requires an `ObjectType` version, and for those `fi.Deleted` is always false via `:2100-2103`.
+- **Zero fan-out (nil clients):** two of three assignments are already no-ops; I traced the `ReplicaStatus` case through `:2081/:2084` and `:1380` for replica and non-replica sources — identical outcome with and without the delta. Pre-existing behavior, already an explicit exclusion.
+- **No re-derivation risk:** `SetDeleteReplicationState` runs only under `opts.EvalMetadataFn != nil` (`erasure-object.go:2030-2038`, `erasure-server-pool-consistency.go:342-351`); `replicateDelete` never sets it, so emptied fields are not refilled with a PENDING decision.
+- **`ReplicationState.Equal`** is used only by `FileInfo.ReplicationInfoEquals` comparing two on-disk infos. No interaction.
+- **Only observable change:** `dobjInfo` handed to `sendEvent` at `:604-610` carries empty `ReplicationStatusInternal`/`ReplicationStatus` instead of bogus `PENDING` for multi-target purges (`erasure-metadata.go:160-162`). Strict improvement; that payload never reflected disk state. Worth one line in the PR description.
+- **Stats / audit / MRF** are computed from `rinfos` before `drs` (`:548-573`). Untouched.
+
+## 4. Sufficiency — yes, for the class
+
+- `getReplicationState` has exactly **one** production caller (`bucket-replication.go:574`). No second write path to patch.
+- With the composite forced empty, the guard is dead for all purges under every (`fi.Deleted`, `updateVersion`) combination — not just the fixture's.
+- `versionPurgeStatusesMap` is not exposed to the same misparse: `VersionPurgeStatusInternal()` skips empty statuses (`:147-149`), so `arn=;` never appears there.
+- After the delta no known producer emits an empty entry at all: purges write `""`; every `!isPurge` exit of `replicateDeleteToTarget` assigns a status (`:640, 664, 681, 695, 715, 725`); the object path pre-initializes `ReplicationStatus: replication.Failed` (`:1338`). Shared parser untouched, as required.
+- No existing test asserts a purge writes a non-empty creation status, so no expected regression. `partial-creation-block` restricts fan-out to one ARN → single entry → composite already `""` → unchanged.
+
+## 5. Non-blocking notes
+
+- **N1 (strongest — promote from optional to required).** The plan's "small invariant over the source update payload **if useful**" is the only thing that can pin `Targets` and `ReplicaStatus`; the disk assertion at `replication-delete-mrf_test.go:353` pins `ReplicationStatusInternal` alone. Make it mandatory: wrap the `ObjectLayer` passed to `replicateDelete` and assert, for every purge subtest, that `opts.DeleteReplication` has all three fields empty and `CompositeReplicationStatus() == ""`. A `replicaSource + unrecordedPurge, targets: 2` case is optional — it may pass either way because the replica timestamp round-trips byte-identically, which is exactly why the payload invariant is the better instrument.
+- **N2.** Tighten §v3's mechanism sentence: `fi.Deleted=false` protects via `DeleteMarkerReplicationStatus()` returning `""` (`erasure-metadata.go:670-675`), not via the guard; record the second masking condition (`erasure-object.go:2102`) confining exposure to delete-marker versions, and the one-shot nature of the corruption.
+- **N3.** State `ReplicaStatus = ""` as defensive (§2), not as a fix for an observed failure.
+- **N4.** Residual, explicitly out of R6: `replStatusRegex` still misparses any future two-empty-entry string. No producer remains after this delta; record as a follow-up issue, do not fix here.
+- **N5.** `drs.ReplicationTimeStamp = UTCNow()` at `:576` is now provably never written for purges. Harmless — leave it rather than widen a three-line delta that has been reviewed field by field.
+- **N6.** For the record: the v2 "empty composite" argument was sound only for a single target; the earlier reviews in this lineage, including the one I am extending, overstated it.
+
+## 6. Consensus
+
+I state consensus on the exact plan content as read, including §A's three-field instruction (line 23) and the §v3 restatement (line 67), subject to the digest caveat. All v2 dispositions and scope limits carry forward unchanged: no merge/publish/deploy, no live storage rewrite, no parser or `getReplicationState` merge change, nil-client and already-erased-tracking states remain excluded, and the 3-endpoint fixture is not a production three-daemon SR mesh. Proceed with the three-field delta plus the N1 payload invariant.
@@ -0,0 +1,25 @@
+{
+  "source_commit": "9ebe81c1b3611f9cc73e676b5b741c2be62c467a",
+  "requested_model": "claude-opus-5",
+  "requested_effort": "max",
+  "cli_version": "2.1.270",
+  "plan": "plan-v3.md",
+  "plan_sha256": "dc9a67fc91b3113fa35218a2f903455807430cc4daf9c78a88d0be6b8fc27058",
+  "assistant_models": [
+    "claude-opus-5"
+  ],
+  "raw_path": "/Users/vonng/tmp/silo-r6-20260915-aa3f/opus-v3.jsonl",
+  "raw_sha256": "7e63d6d522919206d5833b7d908d028123e3a403e9c34a26a07934af79e870c1",
+  "command": "claude --print --model claude-opus-5 --effort max --safe-mode --permission-mode plan --tools Read,Grep,Glob --strict-mcp-config --no-session-persistence --add-dir /Users/vonng/tmp/silo-r6-20260915-aa3f --output-format stream-json --verbose",
+  "auxiliary_usage_models": [
+    "claude-haiku-4-5-20251001",
+    "claude-opus-5"
+  ],
+  "subtype": "success",
+  "is_error": false,
+  "session_id": "07e73b10-dab0-4992-bcad-a71ddac270a3",
+  "duration_ms": 282053,
+  "num_turns": 40,
+  "source_diff": "/Users/vonng/tmp/silo-r6-20260915-aa3f/implementation-v2.diff",
+  "source_diff_sha256": "30f154da13626b5b38b48fbd48755b21a2377ff7b1a5534dc64feda2cc208488"
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Feng Ruohang	9101fe78db	ci: refresh README repository cards daily at 00:00 UTC Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 15:27:48 +08:00
Feng Ruohang	82948d6306	Merge pull request #198 from mrjavadseydi/fix/issue-79-list-multipart-uploads Retain the original contributor commit and integrate the reviewed durable listing, cancellation confirmation and migration fixes. Capacity acceptance and delayed creation-write fencing remain open in issue #79. Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 13:40:10 +08:00
Feng Ruohang	dfb4b2a1d2	fix: return HTTP 503 when multipart scan capacity is exhausted Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 13:24:52 +08:00
Feng Ruohang	143f6970d8	fix: make multipart discovery and cancellation explicit and bounded Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 13:16:37 +08:00
Feng Ruohang	ea5dac5a99	Merge current main into multipart listing contribution Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 12:51:20 +08:00
Feng Ruohang	3c26a8b0b5	Merge pull request #209 from pgsty/codex/credit-console-share-reporter fix: integrate the bounded Console sharing proxy and credit its reporter	2026-09-16 12:19:29 +08:00
Feng Ruohang	2fabd436c0	fix: select the bounded Console sharing proxy Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 12:05:00 +08:00
Feng Ruohang	07c68d6054	docs: credit Jiri Pejchal for the Console sharing report Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 11:48:38 +08:00
Feng Ruohang	9b4ae82a29	Merge pull request #207 from pgsty/codex/conditional-put-pools fix(pools): evaluate cross-pool PUT conditions against the current object	2026-09-16 11:17:02 +08:00
Feng Ruohang	4620be394b	test: synchronize conditional PUT disk fixtures Replace unsynchronized getDisks swaps with backing disk-list updates under erasureDisksMu, matching the existing GetDisks reader lock. Apply the same helper to capacity and read-fault adapters while preserving nested restore ordering. Add a regression that overlaps fixture changes with the real IAM Walk reader, and run the conditional PUT suite under the race detector in CI. The regression reproduces the old fixture race; ten fixed race iterations pass without warnings. Production conditional PUT behavior is unchanged. Refs #199 Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 10:53:24 +08:00
Feng Ruohang	5e7d603083	fix(pools): evaluate cross-pool PUT conditions against the current object Multi-pool PUT selected a destination by capacity and evaluated If-Match/If-None-Match only against that destination's local object state. An empty or stale destination could accept a stale ETag or If-None-Match:* while another pool held the current object, replacing it; a current ETag could instead be rejected with 412 or 404. Under PUT's existing pools-layer object lock, resolve the comparison object with objectPoolInfos (including draining pools), treat a latest delete marker as absence, fail closed on unreadable pool metadata, and clear an accepted callback before destination dispatch. Replica and data-movement callbacks keep their addressed-version semantics and metadata reconciliation. Reproduced on `40220bd836` and RELEASE.2026-09-03T13-18-01Z with six signed HTTP scenarios: four defect cases failed, two controls passed. Refs #199 Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 08:21:21 +08:00
Feng Ruohang	fb7c406ddc	Merge pull request #206 from pgsty/codex/main-consolidation-20260916 test: restore valid credentials in integration fixtures	2026-09-16 08:18:56 +08:00
Feng Ruohang	416826f61f	Merge pull request #205 from pgsty/codex/release-notes-followups docs: complete September correctness and upgrade notes	2026-09-16 08:16:23 +08:00
Feng Ruohang	a2e2f3ee82	test: restore valid credentials in integration fixtures Port the shell-fixture changes from ebc9937d97b27871dcc4bb91d4b5771d3550b76a. Match the existing minimum secret length consistently across startup, aliases and helper commands. Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 08:08:08 +08:00
Feng Ruohang	70c7ec4a9f	docs: link reviewed runbook sources before website deployment Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 08:04:53 +08:00
Feng Ruohang	2b722b7e92	docs: complete September correctness and upgrade notes Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 07:51:11 +08:00
mr javad seydi	4cbb074ccd	fix: make multipart upload listing S3-compatible Signed-off-by: mr javad seydi <seydi.birjand@gmail.com>	2026-09-15 23:17:55 +03:30
Feng Ruohang	40220bd836	Merge pull request #196 from pgsty/codex/merge-r4-r8 Complete R5, R6 and R8 on the main baseline containing R4 and R7. Preserve the individual signed repairs, independent Opus 5 Max review, and integration validation evidence. Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 01:14:06 +08:00
Feng Ruohang	df0dfa0a34	docs: record R4-R8 integration review and validation Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 00:58:31 +08:00
Feng Ruohang	80684fed59	chore: align integrated repair tests with contribution checks Use the actual author and AGPL-3.0-or-later notices for new R6/R8 tests, preserving all test bodies and the Linux build tag. Record the existing replication ARN prefix used by the new R6 fixture in the compatibility inventory; no wire behavior changes. Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 00:44:34 +08:00
Feng Ruohang	055030ea53	fix(http): honor configured request header deadlines Signed-off-by: Feng Ruohang <rh@vonng.com> (cherry picked from commit 0d48d32d7e038ae1ea5966f3d7e0cb86780a6311) Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 00:37:56 +08:00
Feng Ruohang	aea3882c95	docs: record R6 integration verification (cherry picked from commit d38edb2c46182d3a8fa96e040604493d20a4b478) Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 00:37:56 +08:00
Feng Ruohang	0c61128d23	fix(replication): retry marker purges through persisted MRF (cherry picked from commit cf381a7151ef25fc95ace5fedcd767fa19410de2) Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 00:37:55 +08:00
Feng Ruohang	680eac66e4	fix(replication): preserve ordered tag deletions Persist, send and reconcile empty tag states together with their revision across COPY, PUT and multipart replication. Advance local tag mutations under the existing locks and preserve current tags during replication ACK. Cover signed HTTP, persistent single/multiple pool state, KMS, SSE-C key rotation, ordering, retry and duplicate requests. Record real Opus plan consensus, implementation review and local verification evidence. Signed-off-by: Feng Ruohang <rh@vonng.com> (cherry picked from commit 115fe8b12329d147adbaf817faa1737392ecbf9b) Signed-off-by: Feng Ruohang <rh@vonng.com>	2026-09-16 00:37:55 +08:00
Feng Ruohang	9f3037e941	Merge pull request #194 from pgsty/codex/r7-replication-content-encoding fix(replication): preserve normalized replica metadata	2026-09-16 00:31:03 +08:00