Skip to content

Design

32 pages
  • LIST Recovery: Confirm Only Uncertain Names and Bound the Waiting Cost

    In Design

    DesignS3ListObjectsPerformanceReview

    LIST Recovery: Confirm Only Uncertain Names and Bound the Waiting Cost

    Source merged; no new production release: PR #239 merged into main on 2026-10-17 as fbcb51197, closing #218 and retaining the original author commits. Merging source does not update installed software. This is the current design decision for #218 …

    Source merged; no new production release: PR #239 merged into main on 2026-10-17 as fbcb51197, closing #218 and retaining the original author commits. Merging source does not update installed software. This is the current design decision for #218 …

  • IAM Admin API Authorization Boundaries

    In Design

    DesignIAMsecurityCompatibility

    IAM Admin API Authorization Boundaries

    Decision, 2026-10-16: GO; source acceptance and merge complete. Server PR #242 merged the signed repair commit 2616d43fb into main as 4e55fc7db. The final candidate was verified directly on main’s 00a375c4e baseline, independently of the pending LIST …

    Decision, 2026-10-16: GO; source acceptance and merge complete. Server PR #242 merged the signed repair commit 2616d43fb into main as 4e55fc7db. The final candidate was verified directly on main’s 00a375c4e baseline, independently of the pending LIST …

  • Clearing Stale Fields in Legacy Metadata and Scanner Responses

    In Design

    DesignReliabilityStorageScanner

    Clearing Stale Fields in Legacy Metadata and Scanner Responses

    Release follow-up (2026-10-15): This repair first shipped in Server 20261015. The source acceptance below records the earlier pre-release verification. Verified on 2026-10-15: merged on main, not yet in a published Server release. PR #233 was merged …

    Release follow-up (2026-10-15): This repair first shipped in Server 20261015. The source acceptance below records the earlier pre-release verification. Verified on 2026-10-15: merged on main, not yet in a published Server release. PR #233 was merged …

  • Pinned TLS Parameters and Handshake Compatibility

    In Design

    DesignTLSOIDCOperationsCompatibility

    Pinned TLS Parameters and Handshake Compatibility

    Status, 2026-09-17. The Go TLS default repair 48e184652 shipped in Server 20260916. The reporter of issue #154 retested on that release and reports the same connection reset by peer on OIDC discovery. No root cause is established for that …

    Status, 2026-09-17. The Go TLS default repair 48e184652 shipped in Server 20260916. The reporter of issue #154 retested on that release and reports the same connection reset by peer on OIDC discovery. No root cause is established for that …

  • A Listing Must Not Drop a Null Version That Still Has Quorum

    In Design

    DesignS3ListObjectsReview

    A Listing Must Not Drop a Null Version That Still Has Quorum

    Warning 历史 LIST 设计已由新决策覆盖 · Earlier LIST design superseded (2026-10-17) English: The investigation below is retained as historical evidence. Its current-design and pending-work guidance is superseded by the latest LIST recovery decision (English). …

    Warning 历史 LIST 设计已由新决策覆盖 · Earlier LIST design superseded (2026-10-17) English: The investigation below is retained as historical evidence. Its current-design and pending-work guidance is superseded by the latest LIST recovery decision (English). …

  • Go 1.27 TLS Defaults and OIDC Discovery Failure Modes

    In Design

    DesignTLSOIDCOperations

    Go 1.27 TLS Defaults and OIDC Discovery Failure Modes

    Publication update, 2026-09-17: The Go TLS default repair (48e184652) shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The Go TLS default repair (48e184652) shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Request-Header Deadlines: Absolute Header Limits and Rolling Body Idle Timeouts

    In Design

    DesignHTTPS3Review

    Request-Header Deadlines: Absolute Header Limits and Rolling Body Idle Timeouts

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Replica Metadata Normalization: What a Trusted Copy May Not Re-Inject

    In Design

    DesignReplicationS3Review

    Replica Metadata Normalization: What a Trusted Copy May Not Re-Inject

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Replicated Tag Ordering: Revision Timestamps, Tombstones, and Resurrection

    In Design

    DesignReplicationS3Review

    Replicated Tag Ordering: Revision Timestamps, Tombstones, and Resurrection

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • SSE-C Replica Integrity

    In Design

    DesignS3Operations

    SSE-C Replica Integrity

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Object Lock Replication Ordering

    In Design

    DesignS3Operations

    Object Lock Replication Ordering

    Publication update, 2026-09-17: The later repairs in #129, #134 and #178 shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The later repairs in #129, #134 and #178 shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Multi-Pool Object Consistency

    In Design

    DesignS3Operations

    Multi-Pool Object Consistency

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Federated CopyObject: Preserve the Destination Contract

    In Design

    DesignS3Operations

    Federated CopyObject: Preserve the Destination Contract

    Publication update, 2026-09-17: The federated CopyObject repairs recorded here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain …

    Publication update, 2026-09-17: The federated CopyObject repairs recorded here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain …

  • Durable IAM Revocations

    In Design

    DesignS3Operations

    Durable IAM Revocations

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Bucket Configuration Replication: Source Times, Deletions, and Deterministic Convergence

    In Design

    DesignReplicationS3Review

    Bucket Configuration Replication: Source Times, Deletions, and Deterministic Convergence

    Publication update, 2026-09-17: The #77 repair recorded here shipped in Server 20260916; deletion-record export stays off by default. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and …

    Publication update, 2026-09-17: The #77 repair recorded here shipped in Server 20260916; deletion-record export stays off by default. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and …

  • Replication Reliability: Delete Completion, MRF Visibility, and Resync Cancellation

    In Design

    DesignReplicationS3Review

    Replication Reliability: Delete Completion, MRF Visibility, and Resync Cancellation

    Publication update, 2026-09-17: The repairs recorded here (PR #162, the second-round PR #196 and the third-round purge repairs) shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated …

    Publication update, 2026-09-17: The repairs recorded here (PR #162, the second-round PR #196 and the third-round purge repairs) shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated …

  • An Unsigned Header Is Not Part of the Request

    In Design

    DesignsecuritySigV4CopyObjectPresignedCompatibility

    An Unsigned Header Is Not Part of the Request

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • SILO Server 20260903 Pre-release Review

    In Design

    DesignReviewsecurityCompatibilityRelease

    SILO Server 20260903 Pre-release Review

    Warning 旧版分片列举设计已被覆盖 · Earlier multipart-listing designs superseded (2026-10-17) English: The #79 multipart-listing proposals, enablement advice and status in this article are historical. Subsequent design work is governed by the latest design …

    Warning 旧版分片列举设计已被覆盖 · Earlier multipart-listing designs superseded (2026-10-17) English: The #79 multipart-listing proposals, enablement advice and status in this article are historical. Subsequent design work is governed by the latest design …

  • No I/O Before Auth, No Privilege From Headers

    In Design

    DesignsecurityCORSReplicationSSE-CCompatibility

    No I/O Before Auth, No Privilege From Headers

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

  • ListMultipartUploads: Implementation, Upgrade Contract and Design History

    In Design

    DesignS3CompatibilityMultipart

    ListMultipartUploads: Implementation, Upgrade Contract and Design History

    Warning 旧版分片列举设计已被覆盖 · Earlier multipart-listing designs superseded (2026-10-17) English: The August analysis and September legacy/strict proposal retained below are superseded by the latest design decision (English). It selects one persistent …

    Warning 旧版分片列举设计已被覆盖 · Earlier multipart-listing designs superseded (2026-10-17) English: The August analysis and September legacy/strict proposal retained below are superseded by the latest design decision (English). It selects one persistent …

  • Read-Only Checksum Audit and Reliable CLI Output

    In Design

    DesignS3CompatibilityChecksummcli

    Read-Only Checksum Audit and Reliable CLI Output

    This is the design and implementation record for MCLI’s read-only checksum verification workflow and pgsty/mc#5, the non-TTY output defect found during release review. Status: shipped in the final mcli 20260903 release. The command merged to main …

    This is the design and implementation record for MCLI’s read-only checksum verification workflow and pgsty/mc#5, the non-TTY output defect found during release review. Status: shipped in the final mcli 20260903 release. The command merged to main …

  • Two SSE-C Keys, One CopyObject Response

    In Design

    DesignS3SSE-CChecksumCompatibility

    Two SSE-C Keys, One CopyObject Response

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

  • Config Environment Files Are Not Shell Scripts

    In Design

    DesignConfigurationCompatibilityOperations

    Config Environment Files Are Not Shell Scripts

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

  • BadDigest, InvalidRequest, and the CompleteMultipartUpload Checksum Contract

    In Design

    DesignS3CompatibilityChecksum

    BadDigest, InvalidRequest, and the CompleteMultipartUpload Checksum Contract

    Publication update, 2026-09-17: The streaming-checksum follow-up (PR #143) shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The streaming-checksum follow-up (PR #143) shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • A ListObjects Shortcut Must Not Turn a Missing Bucket into an Empty One

    In Design

    DesignS3CompatibilityListObjects

    A ListObjects Shortcut Must Not Turn a Missing Bucket into an Empty One

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

  • One Endpoint, Two Privileges: Separating User and Group Status

    In Design

    DesignIAMsecurityCompatibility

    One Endpoint, Two Privileges: Separating User and Group Status

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

  • Conditional DELETE: One Condition, One Logical Object

    In Design

    DesignS3CompatibilityDELETE

    Conditional DELETE: One Condition, One Logical Object

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Why CompleteMultipartUpload Must Return ChecksumType: Review of PR #57

    In Design

    DesignS3CompatibilityChecksum

    Why CompleteMultipartUpload Must Return ChecksumType: Review of PR #57

    PR #57, contributed by Shooks (@Dansyuqri), fixed #47. The repair is included in Server 20260903. This records the response contract; production deployment remains specific to the artifact and installation an operator actually runs. The defect and …

    PR #57, contributed by Shooks (@Dansyuqri), fixed #47. The repair is included in Server 20260903. This records the response contract; production deployment remains specific to the artifact and installation an operator actually runs. The defect and …

  • Optional Checksums, Mandatory Failure: Repairing UploadPart and UploadPartCopy Compatibility

    In Design

    DesignS3CompatibilityChecksum

    Optional Checksums, Mandatory Failure: Repairing UploadPart and UploadPartCopy Compatibility

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

  • When the Total Is Unknown: Folder Download Progress

    In Design

    DesignConsoleDownload

    When the Total Is Unknown: Folder Download Progress

    Historical scope: this is the Console 2.2.0 progress repair, included in Server 20260903’s embedded Console. Console 2.4.1 subsequently added file streaming and native browser handoff, eliminating the complete JavaScript ZIP Blob. Transport …

    Historical scope: this is the Console 2.2.0 progress repair, included in Server 20260903’s embedded Console. Console 2.4.1 subsequently added file streaming and native browser handoff, eliminating the complete JavaScript ZIP Blob. Transport …

  • Preview Text, Never Execute It: SILO Console Text Preview PRD

    In Design

    DesignConsolepreviewsecurity

    Preview Text, Never Execute It: SILO Console Text Preview PRD

    Status: shipped in SILO Console 2.2.0 · Owner: pgsty/silo-console · Tracking: pgsty/silo#17 · Review: consensus of product, security, and frontend architecture reviews SILO Console can preview images, PDFs, audio, and video, but not the small logs, …

    Status: shipped in SILO Console 2.2.0 · Owner: pgsty/silo-console · Tracking: pgsty/silo#17 · Review: consensus of product, security, and frontend architecture reviews SILO Console can preview images, PDFs, audio, and video, but not the small logs, …

  • DSN-Only Database Notifications: A Compatibility Boundary for #53

    In Design

    DesignNotificationCompatibility

    DSN-Only Database Notifications: A Compatibility Boundary for #53

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …