[Release gate] Verify final artifacts and multi-process stack behavior after the correctness fixes

[Vonng]

Outcome

Produce a single evidence-backed acceptance decision for the final release candidate after the remaining conditional PUT P1 is repaired and release/upgrade notes are ready. This issue is the integration gate for the sibling follow-ups; a passing source build does not establish package/image or deployment acceptance.

Baseline main 40220bd836cbd066ca424fa4dc5dbb90057fb55a has successful Go CI and VulnCheck. No Test Release Pipeline run for this exact SHA was observed. Its path filters do not run it for every storage change. Latest public Server at triage remains RELEASE.2026-09-03T13-18-01Z.

Acceptance

• Link the conditional PUT repair, IAM upgrade/recovery readiness, historical-state readiness and release-note/component-matrix issues and record their disposition.
• Freeze the final candidate SHA and require its full cmd/internal, focused/race regressions, build/verifiers and required CI, including the independent PUT counterexamples.
• Run Test Release Pipeline and validate supported architecture packages/images, embedded commit identity, checksums/signatures/provenance and component manifests.
• Exercise the maintained SILO + Console + mcli + silo-pkg stack using the actual candidate artifacts: login/permissions, S3 upload/download, conditional writes and progressing long transfers.
• Add real multi-process R5/R6/R7 replication checks: offline target/reconnect, process restart, tag deletion and stale events, encrypted retransmission, marker purge and background MRF recovery. Link and reuse the existing R3 evidence where source-equivalent; identify remaining gaps honestly.
• Rehearse the selected coordinated upgrade/restore procedure in isolated environments and record current-object bytes, tags/locks, credential behavior and final replication state.
• Publish a GO/NO-GO decision with exact SHA/artifact digests, topology, test results and known limitations. R9 is explicitly deferred and not a dependency here.

A GO decision and publication/deployment are separate actions. This task permits isolated validation; it does not publish a tag, release, image or website, or modify production data.

Tracking boundary

Baseline: 40220bd836cbd066ca424fa4dc5dbb90057fb55a (main, PR #196), verified 2026-09-16. R1–R8 are closed within their original defect scopes. This issue tracks the follow-up below. R9 / #79 / #198 is explicitly deferred to a separate effort and is not a dependency of this workstream. Source merge, release artifacts and deployment acceptance must be reported separately.

Required follow-ups

• [P1] Evaluate conditional PutObject against the logical object across pools #199 — conditional PUT correctness repair
• [Release] Validate coordinated IAM upgrade, complete backups and rollback #200 — coordinated IAM upgrade/backup/rollback readiness
• [Operations] Prepare a read-only audit and remediation plan for historical replica state #201 — historical-state inventory/remediation readiness
• [Release] Complete correctness-fix notes and the maintained component version matrix #202 — release notes and maintained component matrix

Repository housekeeping: #204 (not a code-release blocker). Start reproducible harness and manifest preparation now; final acceptance waits for the approved candidate SHA.

[Vonng]

Candidate for the 20260916 tag: main 2a4d51406b7ed87af5fe6fe0f801f3290f96eb3c.

Commits since the prepared candidate a2fe70424: fced86303 (pool migration tags), 8d06424b1 (listing null-version quorum), eb4f5e5b3 (exact-version purge intent, write-quorum absence proof, purge vote aggregation, marker heal metadata), 254b19ac0 (queued delete-marker creations re-checked against the source under the replication lock), 358ab38fb (purge response reports a delete marker only for a stored marker), 0596685ae (CHANGELOG), 2a4d51406 (test fixture ARN built at runtime; the first push of this series failed the rebrand guard on a literal in a new test).

Local verification on this tree: go build, go vet, the three rebrand guard commands; the purge/heal/MRF/delete suites (31 tests) plus the two new regressions on the single-drive and 16-drive fixtures; a broad Replicat|DeleteMarker|Purge|MRF|Delete*|Heal*|Dangling subset with no difference from unmodified main apart from the new regressions, and race runs. One adversarial review round (Codex, gpt-6-astra) on the purge changes returned a single should-fix, corrected in 358ab38fb. CI for 2a4d51406: https://github.com/pgsty/silo/actions/runs/35118012313 (in progress at the time of this comment).

Decision for the three correctness items: GO, conditional. Conditions: green CI on 2a4d51406; the maintainer's deep test on the pulled build; release notes carrying the known limits. The tag RELEASE.2026-09-16T00-00-00Z is to be created by the maintainer on the accepted SHA and pushed only after that test.

Remaining gaps, recorded rather than blocking: in-flight or cross-site delete-marker creations and post-crash minority residue (#217); LIST omissions during rolling restarts with concurrent overwrites (#218); the post-repair eight-node rebalance/decommission acceptance for the tag repair was not completed. The three-site evidence for the purge repairs came from a combined build (6f27ee6) containing the same repair, not from the final main; the multi-process replication checklist item above should treat that as the current evidence boundary.

Documentation: Server CHANGELOG 0596685ae; website pgsty/silo.pgsty.com#36.

[Vonng]

CI for 2a4d51406 is green: Go CI https://github.com/pgsty/silo/actions/runs/35118012313 (all six jobs) and VulnCheck https://github.com/pgsty/silo/actions/runs/35118012400. The first condition above is met; the maintainer's deep test on the pulled build and the tag remain.

[Vonng]

The 20260916 Server release is now published from candidate 2a4d51406b7ed87af5fe6fe0f801f3290f96eb3c. The exact tag, GitHub assets, Go/VulnCheck, Test Release Pipeline, release build, package finalization and Docker image publication are now observable.

I am keeping this integration gate open because its acceptance list is broader than artifact publication: it still asks for final-artifact four-component stack checks (login/permissions, S3 operations, conditional writes and long transfers), multi-process R5/R6/R7 replication/recovery checks, and an isolated upgrade/restore rehearsal tied to the released artifacts. The public release notes deliberately retain earlier runtime records' baseline and limitations and do not claim production rollout acceptance.

Please close this issue once those remaining checks are recorded, or narrow the checklist to the artifact gate that is already complete. #79, #217 and #218 remain explicitly deferred known limitations.