OC RELEASE.2026-10-22T16-25-21Z

Independent-user Console and migration preparation

Changes since RELEASE.2026-10-10T11-42-18Z,
source ee1846d587a6548db4e595d653ca4f54baea2b1a, through the current source.
This prepares the next UTC timestamp release; no tag, published artifact, image
digest or completed migration window is declared here.

Changes

• Require Go 1.27.3 across build images and checks; refresh compatible dependencies, OtterIO SDK v7.3.3, OtterIO Kits, and the coordinated OtterIO server source.

• Add a manually triggered immutable-tag preparation workflow that verifies the exact main commit before dispatching the existing draft builder. Publication and packaged-pair acceptance remain separate.

• Add independent native IAM browser login over direct HTTPS. Sessions use each
  enabled IAM user's own credentials and permissions; root, service, STS and
  directory identities are refused. Signed identity revalidation precedes
  authenticated requests. Explicit rejection retires the session; transient
  failure blocks dispatch without destroying it.

• Add OIDC Authorization Code login with S256 PKCE, RS256 verification and
  OtterIO WebIdentity STS. Fixed issuer/client/endpoints and separate IdP/S3/Admin
  trust prevent browser-selected backends. Refresh rotates owned client
  generations without extending the fixed browser lifetime. Cross-site callback,
  logout, unrelated-user isolation and archive/upload ownership fixes accompany
  this mode. Confidential-client secrets use private files.

• Extend native IAM management with relationship-conditioned user, group,
  policy-binding and service-account changes. Reviewed, single-use plans bind
  the exact target, relationship revision and captured affected identities.
  Confirmed or uncertain submissions retire captured local sessions and pending
  logins; definitive refusal preserves them. Creation never replaces an existing
  native target. User lifecycle checks include real service/STS child authority
  and fresh-login boundaries.

• Add authenticated conditional full downloads and single byte ranges with
  GET/HEAD, validators and If-Range handling. Pin reads to the observed
  object/version and verify upstream range replies. Multipart ranges remain
  unsupported; historical versions retain independent permission checks.

• Add permission-scoped Service diagnostics snapshots and bilingual navigation.
  Missing admin:ServerInfo causes denial without privileged fallback.
  Unavailable platform/runtime and global-capacity information is not replaced
  with account-visible bucket totals.

• Fix oc admin policy update checking the wrong error value. Empty arguments
  and already-assigned policies now fail before binding replacement instead of
  potentially clearing assignments. Valid additions retain existing policies.

• Add direct-HTTPS single-instance native/OIDC deployment templates and exact
  candidate-pair verification. Native acceptance checks complete coupled user
  scope and confirms child deletion by signed direct access-key lookup,
  independently of parent-filtered inventory.

• Separate release operations: the tag build stops at a verified stable draft;
  manual publication requires an official successful packaged-pair acceptance
  and rechecks its unchanged asset/image identities; stable promotion is a
  separate manual action. Neither build nor publication changes latest.

Compatibility, deployment and limits

oc and oc-console remain packaged together in eleven platform archives and
Linux amd64/arm64 release images; the image entrypoint remains oc. Go source
builds require 1.27.3. SDK/Admin dependencies remain independently pinned in
compatibility.json and go.mod; they do not identify a remote server. Existing
CLI configuration and supported OC_* / MC_* precedence remain. Older
published artifacts do not acquire these source features automatically.

Choose local alias, native or OIDC mode explicitly. Local mode shares one startup
identity and must not substitute for independent users. Native/OIDC require
browser HTTPS and HTTPS S3/Admin, with fixed endpoints and independent CA trust.
Initial deployment scope is one OC instance; sessions are in memory and restart
requires fresh login. Preferences persist per identity. See the Console guide,
HTTPS recipes and candidate verification.

Writes and sharing remain explicit opt-ins subject to backend permissions.
Native IAM mutations, protected settings and historical versions require matching
server capability/relationship protocols. Unsupported operations are refused or
retain documented read-only behavior. OIDC IAM mutations and Console secret
rotation remain disabled. Native revalidation occurs at request time; it does
not proactively detect external changes or continuously check operations in
flight. Proxy TLS termination, multi-instance sessions, alternate browser engines,
long-running stability and native execution on every cross-built platform are
not certified by source-level acceptance.

Pin both programs/images and back up configuration before rollout. OtterIO with
embedded Web removed retains S3, Admin and STS, but explicitly setting
OTTERIO_BROWSER=on fails startup; it cannot restore the old UI. A verified older
server deployment is needed for that fallback. Returning to an old Console or
server does not undo writes, secret changes or lifecycle transitions; server
downgrades require separate data/configuration compatibility validation. Public
notification, transition and fallback policy remains a release gate. Any revision
to that policy must be announced explicitly, not relabelled as completed.

Build from clean synchronized main after required exact-commit CI and reviewed
CLI/candidate-pair checks. The build verifies thirteen draft assets and pushes
fixed-version images, which may already be public. A stable draft is not an RC.
The official packaged-pair gate must bind
the actual packages, programs and immutable images and pass its declared runtime
and upgrade checks before manual publication. Local source or packaged reports
are not official publication proof. Publication consumes the successful main
run ID and independently reviewed attestation hash, rechecks the same bytes and
leaves latest unchanged. Only separate manual promotion may move it.

The English migration announcement
records the approved accelerated decision: explicit notice plus verified
older-server/snapshot rollback. Its revision is not effective until the first
approved public Web-free release containing that announcement. The October 10
notice remains history; its second-notice/default-off/fallback windows have not
been completed. Review the supported scope and retained-old-program restore
boundary as part of the publication decision. No new tag, deadline, all-platform
runtime certification or passed final artifact run is declared by these notes.
See release and migration gates and
release procedure.

---

The Chinese preparation record below is retained unchanged. Its former
automatic stable publication/promotion description is historical; the current
English procedure above separates draft preparation, verified publication and
manual promotion. No historical migration window is relabelled complete.

独立用户 Console 与迁移准备

本次变化以 RELEASE.2026-10-10T11-42-18Z
为基线，源码为 ee1846d587a6548db4e595d653ca4f54baea2b1a，覆盖其后至当前
源码的变更。本次准备不声明新标签、已发布附件、镜像摘要或已完成的迁移窗口。

本次变化

• 提供直接 HTTPS 的独立 native IAM 登录。每个浏览器使用自己的启用 IAM
  身份，不接受 root、服务账号、STS 或目录身份。请求执行前重新校验签名身份；
  明确拒绝撤销对应会话，临时故障阻止执行但保留会话。
• 提供 OIDC Authorization Code、S256 PKCE、RS256 与 WebIdentity STS。
  固定 issuer/client/后端及独立 CA，刷新替换客户端代次但不延长固定期限。
  修复跨站回调、刷新后的上传/归档归属和登出隔离；client secret 使用私有文件。
• native IAM 用户、组、绑定和服务账号操作采用关系版本条件与一次性确认
  计划，绑定准确目标及受影响身份。结果确认或不确定时撤销捕获范围的
  本机会话及待登录，明确拒绝保留会话。创建不覆盖身份；生命周期验证包括
  真实 service/STS 子身份权限和同名重建不恢复旧会话。
• 提供条件完整下载和单段 Range，支持 GET/HEAD、validators、If-Range，
  固定实际对象/版本并校验上游响应；不支持多段 Range，历史版本单独授权。
• 提供按身份权限读取的服务诊断快照及中英文导航；缺少 admin:ServerInfo
  时拒绝，不借用管理员。平台/运行时和全局容量不可用时保持明确缺失。
• 修复 oc admin policy update 检查错误变量：空参数或已有绑定在替换前
  拒绝，不再可能清空绑定；合法新增保留现有策略。
• 补充 native/OIDC 单实例 HTTPS 配方与精确候选配对。原生验收检查完整
  用户影响范围，并按子账号 access key 直接签名查询，不能仅用父过滤列表证明删除。

升级与兼容性

继续在 11 个平台归档和 Linux amd64/arm64 镜像中分发 oc 与 oc-console，
默认入口为 oc。源码要求 Go 1.27.2，SDK/Admin 固定依赖不是远程服务端身份。
保留现有 CLI 配置与受支持的 OC_*／MC_* 规则；旧发行包不自动获得新功能。

local 共用一个 alias 身份；独立用户选择 native 或 OIDC。首批为 OC 直接处理
浏览器 TLS 的单实例，使用实际 HTTPS S3/Admin 地址及独立 CA。会话在内存中，
重启后重新登录，偏好按身份持久保存，见控制台指南、
HTTPS 配方及候选验收。

写入和分享需显式开启及实际权限；IAM、设置、历史版本需对应能力/关系协议，
缺失时拒绝或只读。OIDC IAM 写入和 Console 改密仍禁用。请求前校验不等于
主动检测外部变化或持续轮询在途操作。代理 TLS 终止、多实例、其他浏览器、
长期稳定性及全部交叉编译平台的原生运行未由开发验收认证。

删除版 OtterIO 保留 S3/Admin/STS，但 OTTERIO_BROWSER=on 拒绝启动，不能
恢复旧 UI；回退旧服务端需验证数据和配置兼容性。回退不撤销写入、改密和
生命周期转换。通知、过渡与回退政策仍是发行门槛，修订时必须明确公告。

正式发布需从干净同步的 main 开始，在同一提交完成要求的 CI 和候选配对，
再核验 13 个附件、程序校验和、镜像身份及承诺的升级路径。开发报告不等于
正式产物认证。关闭 latest promotion 仍创建 stable，不会创建 RC，见
迁移门槛和发行流程。

OC RELEASE.2026-10-10T11-42-18Z

OC Console distribution and object management update

Changes since RELEASE.2026-10-09T17-33-03Z
(source 99c6728ee75d10aaa7b6932a0ec07764258aa4ca). This preparation
uses UTC timestamp tags and does not reserve a tag or publish artifacts.

Changes

• Distribute oc-console alongside oc in all eleven platform archives and
  Linux amd64/arm64 release images. Both programs report the release tag;
  packaging checks verify executable bytes, licenses and checksums. The image
  defaults to oc; start the console with --entrypoint oc-console.
• Improve console object management, navigation and localization. Add persistent
  preferences and recent bucket visits, with platform-appropriate preference
  file permission checks on Windows.
• Add a Docker Compose example for the local single-identity console. It sets
  OTTERIO_BROWSER=off while retaining the internal Admin listener. The example
  pins OtterIO RELEASE.2026-10-09T15-22-07Z and currently builds OC locally.
• Fix console formatting and error-string lint findings.

Compatibility and upgrade

Go source builds require 1.27.2. This release retains the existing dependency
pins: S3 SDK github.com/soulteary/otterio-sdk/v7 v7.3.2, server/admin module
github.com/soulteary/otterio v0.0.0-20261009091443-bcc238bc4c2c,
crc64nvme v1.1.3, md5-simd v1.2.0 and urfave/cli v3.14.0.
These build identities do not identify a remote server or establish compatibility
with every historical OtterIO or third-party S3 service.

Known policy-update limitation: oc admin policy update can clear a user's
or group's policy assignments when passed an already assigned policy or an empty
policy argument. This release does not fix that defect. Read the existing
assignments with oc admin user info or oc admin group info, then use
oc admin policy set with the complete desired comma-separated policy list and
verify the result. See administration guidance.

Existing CLI configuration and OC_* / supported MC_* precedence remain.
Back up configuration and pin release images or manifest digests before upgrading.
Older archives and images are not retroactively updated with the console.

The console uses one configured alias identity for all local browser sessions.
Writes and sharing require explicit opt-in; protected operations also require
matching server capabilities and permissions. Independent-user/OIDC login and
Range downloads remain outside this scope. See the console guide
and migration and rollback gates.
OtterIO's browser default remains unchanged. Restoring OTTERIO_BROWSER=on
does not undo object writes, settings, secret rotation or lifecycle transitions.

Release from a clean synchronized main only after Go, Code scanning and the
separate CLI compatibility checks pass on that exact source. Verify thirteen
published assets and immutable image digests before rollout. Eleven cross-built
archives and two image architectures do not prove native execution on every
platform. See the preparation record
and release procedure.

---

OC Console 分发与对象管理更新

本次变化以 RELEASE.2026-10-09T17-33-03Z
为基线，源码为 99c6728ee75d10aaa7b6932a0ec07764258aa4ca。
继续使用 UTC 时间戳标签；本次准备不预留标签或发布附件。

本次变化

• 11 个平台归档和 Linux amd64/arm64 发行镜像同时包含 oc 与 oc-console。
  两个程序显示发行标签，打包检查核对程序字节、许可证和校验值。
  镜像默认入口仍为 oc，使用 --entrypoint oc-console 启动控制台。
• 完善控制台对象管理、导航和多语言界面，持久保存偏好及最近访问的桶；
  Windows 偏好文件检查按该平台的权限语义执行。
• 提供本机单身份控制台的 Docker Compose 示例，以 OTTERIO_BROWSER=off
  关闭旧 Web，同时保留内部 Admin 监听。示例固定 OtterIO
  RELEASE.2026-10-09T15-22-07Z，OC 当前仍使用本地构建镜像。
• 修复控制台格式与错误字符串的 lint 问题。

升级与兼容性

源码构建要求 Go 1.27.2。依赖继续固定为 S3 SDK v7.3.2、服务端 / 管理模块
v0.0.0-20261009091443-bcc238bc4c2c、crc64nvme v1.1.3、md5-simd v1.2.0
及 urfave/cli v3.14.0；它们不是远程服务端身份或历史版本、第三方 S3 的通用兼容证明。

已知策略更新限制： oc admin policy update 遇到已绑定的策略或空策略参数时，
可能清空用户或组的策略绑定，本次发布尚未修复。先用 oc admin user info 或
oc admin group info 读取现有绑定，再用 oc admin policy set 提交期望保留的
完整策略列表（多个策略以逗号分隔），并核对结果，见管理说明。

保留现有 CLI 配置和 OC_* 优先于受支持 MC_* 的规则。升级前备份配置，
固定版本或清单中的镜像摘要。已发布的旧归档和镜像不会补入控制台。
所有本机浏览器会话共用启动时的别名身份；写操作与分享需显式开启，受保护操作
还需服务端能力和当前身份权限。独立用户 / OIDC 登录及 Range 下载仍不在范围内。
见控制台指南及迁移与回退条件。
OtterIO 的浏览器默认值不变。恢复 OTTERIO_BROWSER=on 不会撤销已完成的写入、
配置、改密或生命周期转换。

最终发布需从干净且同步的 main 开始，同一提交的 Go、代码扫描和独立 CLI 兼容
检查全部通过。上线前核验 13 个附件和不可变镜像摘要。交叉编译和双架构镜像
不能代替各平台原生运行验收，见准备记录
与发行流程。

OC RELEASE.2026-10-09T17-33-03Z

OC console, CLI and SDK update

This release preparation covers changes after the published
RELEASE.2026-10-07T17-07-26Z
(source eeb95dbeeca8d80ae3e86e133228615ba84e02ce). The next release keeps
OtterIO's UTC RELEASE.YYYY-MM-DDTHH-MM-SSZ tag format. The preparation PR does
not reserve a tag or publish archives or images.

Changes

• Add the optional, source-built oc-console for one operator and one local S3
  alias. It provides authenticated browsing and streaming downloads by default.
  Explicit --allow-writes adds uploads, confirmed object/batch/prefix deletion,
  cancellation and per-object results. Credentials stay in OC; operations use
  the selected identity and verified TLS. See the console guide.
• Keep create-only uploads atomic on the pinned OtterIO FS and single-pool
  erasure server using its conditional-write capability. Servers without that
  guarantee reject default uploads; explicit replacement needs separate
  confirmation. Canceled transfers attempt cleanup of their own multipart
  uploads, and uncertain commits or failed cleanup remain visible.
• Read complete bucket policy JSON and versioning/lifecycle XML in the console.
  With --allow-writes and the matching console base protocol, review and apply
  revision-protected replacements, remove policy/lifecycle configurations, and
  rotate the selected native IAM user's secret. Rotation retires local sessions
  and requires updating the alias in the terminal before restarting.
• Add confirmed bucket creation/empty-bucket deletion, native IAM user/group/
  service-account management, historical version selection, ZIP downloads and
  opt-in presigned sharing to the source-built console. Protected version and
  IAM operations require their matching server protocols. See
  feature scope and validation.
• Add labeled ILM destinations to oc admin bucket remote and require the
  native lifecycle-transition capability before adding, editing or removing an
  ILM target. The matching base/storage/hardening patches implement current and
  noncurrent transitions, persistent destination references and version-specific S3
  restore on single-node, single-pool erasure. See runtime scope and evidence.
• Migrate OC and its server/admin dependency to urfave/cli v3.14.0. Preserve
  command scope, environment and list parsing, help, completion, initialization,
  output streams and signal cleanup using frozen old-binary contracts. Correct
  health usage-error rendering so invalid input reports an argument error
  instead of panicking. Go API consumers must follow the CLI migration guide.
• Use the independently released github.com/soulteary/otterio-sdk/v7 v7.3.1
  for S3 operations and the published OtterIO kits crc64nvme v1.1.2 and
  md5-simd v1.1.3. Preserve SDK package names, checksums and transfer behavior;
  the source migration does not change OC configuration or storage formats.
• Pin server/admin packages and the integration server to merged OtterIO source
  6f6d0835ddff68020f1491c403b958fade22841f, including the CLI and SDK/kits
  migrations. Its tree matches the previously pinned fed9cc3 source; this pin
  change records the accepted main commit rather than adding another runtime fix.
  Record the independent SDK, kits and server identities separately in
  compatibility and release manifests.
• Retire Windows notification handles before closing them, so late successful
  zero-byte completions from intentional shutdown do not report event loss or
  trigger unnecessary mirror reconciliation.
• Compare transfer throughput with fresh destinations and three fixed,
  alternating measured/reference pairs after warmup. Retain every download's
  hash check and the existing 5 MiB/s floor, 50% ratio and 512 MiB memory budget.
  Combine sampled RSS with each process's exit-accounted peak so short transfers
  still receive a memory measurement.
• Parallelize cross-compilation, refresh compatible Go build caches and update
  English/Chinese onboarding, administration and console guides. Record the two
  intended ILM help changes as exact Unix/Windows approvals; retain the fixed
  baseline and strict checks for all other CLI output and behavior.

Compatibility and upgrade

The OC module remains github.com/soulteary/mc; source builds require Go 1.27.2.
OC's S3 client SDK is separate from its OtterIO server/admin module. Exact pins,
source identities and validation limits are recorded in
compatibility.json and the
compatibility guide. SDK extraction and independent
publication are complete; notification stream delivery fixes remain deferred.
Live notifications still have no durable replay cursor.

oc admin policy update currently fails to stop on an already assigned or empty
policy argument and can submit an empty replacement. Read the existing user/group
assignments first and use policy set with the complete desired policy list;
see administration guidance.

Existing OC CLI commands, configuration and timestamp release conventions remain
in place. OC_* settings take precedence over supported legacy MC_* settings.
Back up configuration before importing from mc. Use verified OC release assets
and check oc --version; MinIO self-update and SUBNET upload remain disabled.

The experimental console is built with make build-console. The current CLI
archives, GHCR images and container workflow do not package it. A dedicated
console image and macOS Podman Compose deployment have not been delivered;
macOS users can run the native console against mapped S3/admin ports. Keep it on
literal loopback for a single operator. It provides the five console features
described above; OIDC, centralized deployment and historical restore/permanent
deletion buttons remain outside this implementation.
Default create-only uploads require the recorded server capability. Ordinary
S3 operations and OtterIO administrative operations have different compatibility
requirements; no blanket historical-server or third-party S3 claim is added.

The fixed OtterIO pin does not contain the optional console protocols. On a
clean writable copy of that pin, apply console base
for protected settings and own credentials. The five-feature server adds
version authorization, then
conditional IAM. Lifecycle deployment
instead requires base, lifecycle storage
and mandatory lifecycle hardening;
the full composition adds versions and IAM after those three layers. See
separate source builds and validation.
The old console-server-p3.patch is frozen historical evidence and must not be
used as a current deployment input or combined with the new exports. Current
OtterIO HEAD80 already contains P3 and lifecycle hardening, while its working
source has separate authorization repairs; it lacks the independent conditional
IAM protocol. Do not reapply the fixed-pin export stack there. Building OC does
not upgrade the server, and the five-feature IAM proof uses independent patched
builds rather than that current checkout.
Older servers retain configuration reads while protected mutations remain
disabled. Returning to the old UI does not undo saved rules, credentials or
transitioned data; a server with new transition references cannot be downgraded
directly to a server that cannot read them.

After this PR merges, release only from a clean, synchronized main commit with
passing Go and Code scanning - action runs for that exact source. The
separate CLI compatibility result also needs review; the release job does
not automatically enforce it. The new ILM help contracts are approved, and all
339 cases passed on Linux, macOS and Windows for the reviewed pre-PR main
f7b784affbf3e3d4d7c54663932d9d1925dca2b3; review the final merged source again.
The workflow produces eleven CLI archives, a manifest and
checksums, plus verified
Linux amd64/arm64 image identities where configured. Cross-compilation does not
establish native runtime acceptance on every target. See the
2026-10-08 preparation record and
release procedure.

---

OC 控制台、CLI 与 SDK 更新

本次发布准备覆盖已发布版本
RELEASE.2026-10-07T17-07-26Z
之后的变化，比较基线源码为 eeb95dbeeca8d80ae3e86e133228615ba84e02ce。
后续版本继续使用 OtterIO 的 UTC RELEASE.YYYY-MM-DDTHH-MM-SSZ 标签。
准备 PR 不预留标签，也不发布程序归档或容器镜像。

本次变化

• 新增可选的源码构建程序 oc-console，供一个操作员通过本机已配置的 S3 别名使用。
  默认提供登录保护的浏览和流式下载；显式开启 --allow-writes 后支持上传、确认后
  删除对象 / 批量 / 前缀、取消和逐项结果。凭据留在 OC，操作遵循当前身份的实际权限，
  TLS 证书验证保持开启，见控制台说明。
• 默认上传依赖固定版本 OtterIO 在 FS 和单 pool erasure 上的条件写能力，保证并发时
  不覆盖已有对象。缺少该保证的服务端会拒绝默认上传；替换需要单独确认。
  取消时清理本次创建的分片上传，提交结果未确认或清理失败会明确显示。
• 控制台读取完整桶策略 JSON、版本及生命周期 XML。显式开启 --allow-writes 且服务端
  具备配套基础协议时，可以复核并提交受 revision 保护的完整配置替换、删除策略或
  生命周期配置，以及修改当前原生 IAM 用户的 secret。改密会撤销本机会话，需要在
  终端更新别名后重新启动。
• 源码构建的控制台增加确认后创建桶/删除空桶、原生 IAM 用户/组/服务账号管理、
  历史版本选择、ZIP 下载和显式开启的预签名分享。受保护的版本及 IAM 操作还需
  服务端提供相应协议，见功能范围与验收。
• oc admin bucket remote 增加带 label 的 ILM 目标；添加、编辑及删除 ILM 目标前
  必须确认服务端的原生转换能力。配套 base/storage/hardening 补丁在单节点、单 pool
  erasure 上实现当前/非当前版本转换、持久化目标引用和指定版本的 S3 恢复，见
  执行边界与验证。
• OC 与服务端 / 管理包依赖迁移到 urfave/cli v3.14.0，用冻结的旧程序合同保留参数
  作用域、环境与列表解析、帮助、补全、初始化、输出流及信号清理。修复 health 用法
  错误渲染，使非法输入显示参数错误而不再 panic。Go API 调用者需按
  CLI 迁移说明更新类型并重新编译。
• S3 操作采用独立发布的 `github.com/soulteary/otterio-sdk/v7 ...

OC RELEASE.2026-10-09T14-38-15Z

OC dependency and console update

Changes since RELEASE.2026-10-08T15-23-26Z.

• Extend the optional source-built console with bucket creation/deletion, IAM users/groups/service accounts, historical version selection, ZIP downloads and opt-in presigned sharing. Protected operations require matching server capabilities; console binaries are not included in CLI archives or images.
• Upgrade the S3 client to otterio-sdk/v7 v7.3.2, kits to crc64nvme v1.1.3 and md5-simd v1.2.0, and golang.org/x/sys to v0.49.0.
• Update the OtterIO server/admin dependency to v0.0.0-20261009091443-bcc238bc4c2c and synchronize the compatibility manifest. Building OC does not upgrade a deployed server.
• Require Go 1.27.2 for source builds; refresh English/Chinese READMEs and isolate historical console fixtures, IAM topology checks and Windows mode assertions in CI.

Source: c62be561ef03f9b7749c53a2e71b3886efa76db4. Go, Code scanning and CLI compatibility passed on this exact main commit. The frozen CLI contracts passed on Linux, macOS and Windows.

This release contains eleven CLI archives, release-manifest.json and checksums.txt, plus Linux amd64/arm64 container images. Use the manifest for exact dependency identities and image digests; cross-compilation does not establish native runtime acceptance for every target.

The console remains experimental and source-built for a single operator on literal loopback. See console feature scope and compatibility for server requirements and validation limits.

Known limitation: oc admin policy update can submit an empty replacement for already assigned or empty policy arguments. Read existing assignments and use policy set with the complete desired list.

中文说明

本次发布基于上一版本 RELEASE.2026-10-08T15-23-26Z，新增源码构建控制台的桶管理、IAM 用户/组/服务账号管理、历史版本选择、ZIP 下载及显式启用的预签名分享。受保护操作仍需要匹配的服务端能力，正式 CLI 归档和镜像不包含控制台。

升级 S3 SDK 至 v7.3.2、crc64nvme 至 v1.1.3、md5-simd 至 v1.2.0、x/sys 至 v0.49.0；服务端/管理依赖固定为 bcc238bc4c2c，兼容清单同步更新。源码构建需要 Go 1.27.2，同时更新中英文说明并修复 CI 的历史控制台夹具、IAM 拓扑及 Windows 权限断言隔离。

发布源码的 Go、代码扫描及三平台 CLI 兼容检查全部通过。提供 11 个平台的 CLI 归档、发布清单、SHA-256 校验文件及 Linux amd64/arm64 镜像。部署服务端不会随客户端构建自动升级；各平台交叉编译不等同于全部平台原生运行验收。

OC RELEASE.2026-10-08T15-23-26Z

OC console, CLI and SDK update

This release preparation covers changes after the published
RELEASE.2026-10-07T17-07-26Z
(source eeb95dbeeca8d80ae3e86e133228615ba84e02ce). The next release keeps
OtterIO's UTC RELEASE.YYYY-MM-DDTHH-MM-SSZ tag format. The preparation PR does
not reserve a tag or publish archives or images.

Changes

• Add the optional, source-built oc-console for one operator and one local S3
  alias. It provides authenticated browsing and streaming downloads by default.
  Explicit --allow-writes adds uploads, confirmed object/batch/prefix deletion,
  cancellation and per-object results. Credentials stay in OC; operations use
  the selected identity and verified TLS. See the console guide.
• Keep create-only uploads atomic on the pinned OtterIO FS and single-pool
  erasure server using its conditional-write capability. Servers without that
  guarantee reject default uploads; explicit replacement needs separate
  confirmation. Canceled transfers attempt cleanup of their own multipart
  uploads, and uncertain commits or failed cleanup remain visible.
• Read complete bucket policy JSON and versioning/lifecycle XML in the console.
  With --allow-writes and the matching P3 server protocol, review and apply
  revision-protected replacements, remove policy/lifecycle configurations, and
  rotate the selected native IAM user's secret. Rotation retires local sessions
  and requires updating the alias in the terminal before restarting.
• Add labeled ILM destinations to oc admin bucket remote and require the
  native lifecycle-transition capability before adding, editing or removing an
  ILM target. The matching optional server patch implements current/noncurrent
  transitions, persistent destination references and version-specific S3
  restore on single-node, single-pool erasure. See runtime scope and evidence.
• Migrate OC and its server/admin dependency to urfave/cli v3.14.0. Preserve
  command scope, environment and list parsing, help, completion, initialization,
  output streams and signal cleanup using frozen old-binary contracts. Correct
  health usage-error rendering so invalid input reports an argument error
  instead of panicking. Go API consumers must follow the CLI migration guide.
• Use the independently released github.com/soulteary/otterio-sdk/v7 v7.3.1
  for S3 operations and the published OtterIO kits crc64nvme v1.1.2 and
  md5-simd v1.1.3. Preserve SDK package names, checksums and transfer behavior;
  the source migration does not change OC configuration or storage formats.
• Pin server/admin packages and the integration server to merged OtterIO source
  6f6d0835ddff68020f1491c403b958fade22841f, including the CLI and SDK/kits
  migrations. Its tree matches the previously pinned fed9cc3 source; this pin
  change records the accepted main commit rather than adding another runtime fix.
  Record the independent SDK, kits and server identities separately in
  compatibility and release manifests.
• Retire Windows notification handles before closing them, so late successful
  zero-byte completions from intentional shutdown do not report event loss or
  trigger unnecessary mirror reconciliation.
• Compare transfer throughput with fresh destinations and three fixed,
  alternating measured/reference pairs after warmup. Retain every download's
  hash check and the existing 5 MiB/s floor, 50% ratio and 512 MiB memory budget.
  Combine sampled RSS with each process's exit-accounted peak so short transfers
  still receive a memory measurement.
• Parallelize cross-compilation, refresh compatible Go build caches and update
  English/Chinese onboarding, administration and console guides. Record the two
  intended ILM help changes as exact Unix/Windows approvals; retain the fixed
  baseline and strict checks for all other CLI output and behavior.

Compatibility and upgrade

The OC module remains github.com/soulteary/mc; source builds require Go 1.27.1.
OC's S3 client SDK is separate from its OtterIO server/admin module. Exact pins,
source identities and validation limits are recorded in
compatibility.json and the
compatibility guide. SDK extraction and independent
publication are complete; notification stream delivery fixes remain deferred.
Live notifications still have no durable replay cursor.

oc admin policy update currently fails to stop on an already assigned or empty
policy argument and can submit an empty replacement. Read the existing user/group
assignments first and use policy set with the complete desired policy list;
see administration guidance.

Existing OC CLI commands, configuration and timestamp release conventions remain
in place. OC_* settings take precedence over supported legacy MC_* settings.
Back up configuration before importing from mc. Use verified OC release assets
and check oc --version; MinIO self-update and SUBNET upload remain disabled.

The experimental console is built with make build-console. The current CLI
archives and container workflow do not package it. Keep it on literal loopback
for a single operator; it does not replace the existing OtterIO Web console or
provide OIDC, centralized deployment, IAM user/group/service-account management,
object version selection or restore buttons.
Default create-only uploads require the recorded server capability. Ordinary
S3 operations and OtterIO administrative operations have different compatibility
requirements; no blanket historical-server or third-party S3 claim is added.

The pinned OtterIO server does not contain the P3 settings, own-credentials or
lifecycle-transition protocols. They require the optional server patch
and its separate validation.
Older servers retain configuration reads while protected mutations remain
disabled. Returning to the old UI does not undo saved rules, credentials or
transitioned data; a server with new transition references cannot be downgraded
directly to a server that cannot read them.

After this PR merges, release only from a clean, synchronized main commit with
passing Go and Code scanning - action runs for that exact source. The
separate CLI compatibility result also needs review; the release job does
not automatically enforce it. The new ILM help contracts are approved, and all
339 cases passed on Linux, macOS and Windows for the reviewed pre-PR main
f7b784affbf3e3d4d7c54663932d9d1925dca2b3; review the final merged source again.
The workflow produces eleven CLI archives, a manifest and
checksums, plus verified
Linux amd64/arm64 image identities where configured. Cross-compilation does not
establish native runtime acceptance on every target. See the
2026-10-08 preparation record and
release procedure.

---

OC 控制台、CLI 与 SDK 更新

本次发布准备覆盖已发布版本
RELEASE.2026-10-07T17-07-26Z
之后的变化，比较基线源码为 eeb95dbeeca8d80ae3e86e133228615ba84e02ce。
后续版本继续使用 OtterIO 的 UTC RELEASE.YYYY-MM-DDTHH-MM-SSZ 标签。
准备 PR 不预留标签，也不发布程序归档或容器镜像。

本次变化

• 新增可选的源码构建程序 oc-console，供一个操作员通过本机已配置的 S3 别名使用。
  默认提供登录保护的浏览和流式下载；显式开启 --allow-writes 后支持上传、确认后
  删除对象 / 批量 / 前缀、取消和逐项结果。凭据留在 OC，操作遵循当前身份的实际权限，
  TLS 证书验证保持开启，见控制台说明。
• 默认上传依赖固定版本 OtterIO 在 FS 和单 pool erasure 上的条件写能力，保证并发时
  不覆盖已有对象。缺少该保证的服务端会拒绝默认上传；替换需要单独确认。
  取消时清理本次创建的分片上传，提交结果未确认或清理失败会明确显示。
• 控制台读取完整桶策略 JSON、版本及生命周期 XML。显式开启 --allow-writes 且服务端
  具备配套 P3 协议时，可以复核并提交受 revision 保护的完整配置替换、删除策略或
  生命周期配置，以及修改当前原生 IAM 用户的 secret。改密会撤销本机会话，需要在
  终端更新别名后重新启动。
• oc admin bucket remote 增加带 label 的 ILM 目标；添加、编辑及删除 ILM 目标前
  必须确认服务端的原生转换能力。配套可选服务端补丁在单节点、单 pool erasure 上
  实现当前/非当前版本转换、持久化目标引用和指定版本的 S3 恢复，见
  执行边界与验证。
• OC 与服务端 / 管理包依赖迁移到 urfave/cli v3.14.0，用冻结的旧程序合同保留参数
  作用域、环境与列表解析、帮助、补全、初始化、输出流及信号清理。修复 health 用法
  错误渲染，使非法输入显示参数错误而不再 panic。Go API 调用者需按
  CLI 迁移说明更新类型并重新编译。
• S3 操作采用独立发布的 github.com/soulteary/otterio-sdk/v7 v7.3.1，并使用已发布的
  OtterIO kits crc64nvme v1.1.2、md5-simd v1.1.3。保留 SDK 的包名、校验和及
  传输行为；源码迁移不改变 OC 配置或存储格式。
• 服务端 / 管理包和集成服务端固定到已经合并的 OtterIO 提交
  6f6d0835ddff68020f1491c403b958fade22841f，包含 CLI 与 SDK/kits 迁移。
  其源码树与原先固定的 fed9cc3 一致；本次换 pin 记录正式合并的 main 来源，
  没有新增运行时修复。兼容与发布清单分别记录独立 SDK、kits 和服务端身份。
• Windows 通知句柄在关闭前先标记退役，避免主动停止后到达的成功零字节完成事件
  被误报为事件丢失，进而触发不必要的镜像状态核对。
• 吞吐验收在预热后使用全新目标和固定三组交替测量 / 参考传输，保留每次下载的
  hash 检查，以及既有 5 MiB/s 下限、50% 比例与 512 MiB 内存预算。
  内存检查结合定时采样与每个子进程退出时记录的峰值，短传输也能保留测量结果。
• 并行执行交叉编译，更新兼容的 Go 构建缓存，并同步中英文入门、管理与控制台指南。
  将两项有意新增的 ILM 帮助文本登记为精确 Unix / Windows 批准差异；
  固定历史基线与其他 CLI 输出、行为检查保持严格。

升级与兼容性

OC 的 Go 模块仍为 github.com/soulteary/mc，源码构建要求 Go 1.27.1。
S3 客户端 SDK 与 OtterIO 服务端 / 管理模块是独立依赖，准确版本、源码身份和验证边界
见兼容清单及兼容说明。
SDK 提取和独立发布已经完成；通知流投递修复仍延期，实时通知仍无持久化重放游标。

oc admin policy update 当前遇到已绑定或空策略参数时没有停止请求，可能提交空替换值。
先读取用户 / 组的现有绑定，再用 policy set 提交期望保留的完整策略列表，见
管理说明。

保留现有 OC CLI 命令、配置和时间戳发布约定。OC_* 优先于继续支持的旧 MC_* 设置。
导入 mc 配置前先备份。使用经过验证的 OC 发布附件并检查 oc --version；
MinIO 自更新与 SUBNET 上传保持禁用。

实验控制台通过 make build-console 构建，当前 CLI 归档和容器工作流不打包该程序。
仅供一个操作员在回环 IP 地址使用，不取代现有 OtterIO Web 控制台；
尚不提供 OIDC、集中部署、IAM 用户/组/服务账号管理、对象版本选择或恢复按钮。
默认不覆盖上传要求服务端具备记录的条件写能力。普通 S3 操作与 OtterIO 管理操作有各自的兼容要求，
本次没有扩大为全部历史服务端或第三方 S3 均兼容的承诺。

固定 OtterIO 服务端尚未包含 P3 桶配置、自身凭据及生命周期转换协议；这些能力需要
可选服务端补丁，并按独立验证记录
确认范围。旧服务端保留配置读取，受保护修改继续禁用。退回原 UI 不会撤销已保存规则、
secret 或转换数据；存在新转换引用时，不能直接降级到不理解该引用的服务端。

本 PR 合并后，只能从干净且与远程同步的 main 创建发布，并要求 Go 和
Code scanning - action 在同一源码提交上通过。
...

OC RELEASE.2026-10-07T17-07-26Z

OC client reliability and release update

This update includes the changes after Git tag RELEASE.2026-10-07T04-39-33Z.
That tag is a source baseline; it does not establish that GitHub release assets
were published. The release uses OtterIO's UTC timestamp tag format.

Changes

• Fix Windows notification decoding without weakening race/checkptr checks.
  Preserve asynchronous read buffers until cancellation completes, close idle
  handles, and keep old completions from removing replacement watches. Report
  genuine event loss so live mirrors reconcile their state.
• Handle Windows filename limits, OS-blocked staging-directory replacement and
  unsupported filesystem attributes. Synchronize periodic mirror recovery with
  scan/copy worker shutdown.
• Harden configuration import, endpoint validation and configuration cache access.
  Keep JSON errors on one line with structured categories and codes when available. Correct live
  mirror filtering and event handling.
• Validate object-lock durations and calendar bounds before arithmetic or copying
  data. Reject out-of-range retention dates before data transfer; retain supported
  clear requests and public interfaces.
• Update the Go vulnerability scanner for Go 1.27 and use the existing transfer
  deadline when observing throttled multipart progress. Keep cancellation,
  throughput and residual-session assertions.
• Add timestamp-based binary publication with exact-source main CI checks,
  eleven platform archives, SHA-256 checksums, source identity and licenses.
  Upload to a stable draft and verify every downloaded asset before publication.
• Publish Linux amd64/arm64 container images to GHCR, with optional Docker Hub
  publication. Package the exact release executables, verify pushed image digests
  before publishing the GitHub release and record those digests in the manifest.
  Keep version tags immutable; promote the newest published stable release to
  latest separately by digest, then update GitHub's latest release marker.
• Replace inherited installation/support instructions with task-oriented OC
  documentation in English and Simplified Chinese: installation, containers,
  configuration, transfers, migration, administration and troubleshooting.
  Add command, compatibility, security, development and maintainer guides, and
  preserve dated validation records with links to current instructions.

Compatibility and upgrade

The module path remains github.com/soulteary/mc. The OtterIO SDK remains pinned
to v0.0.0-20261004215341-be8596f0d69d; the compatibility fixture applies the
three recorded server patches. This release does not claim compatibility with
all historical OtterIO versions or every third-party S3 service.
See the compatibility manifest and
current validation scope.

OC uses its own configuration directory. Back up configuration before importing
from mc; import replaces destination aliases after validation and a private backup.
OC_* settings take precedence over supported legacy MC_* settings.
MinIO self-update and SUBNET upload remain disabled. Replace the executable using
verified release assets and check oc --version; the Windows archive contains
oc.exe. Test aliases, TLS, copy/mirror filters and object-lock operations before
rollout. Notifications have no durable replay cursor.

Select a release whose manifest contains images; archive-only releases,
including RELEASE.2026-10-07T14-10-00Z, have no container image identities.
Container images use ghcr.io/soulteary/oc:<release-tag>. Mount /root/.oc for
persistent configuration. Pin a version tag or manifest digest for deployments;
latest is a moving alias. Docker Hub publication requires both
DOCKERHUB_USERNAME and DOCKERHUB_TOKEN repository Actions secrets. A partially
pushed version requires a fresh release tag; a failed latest update can be
retried through Stable release promotion without rebuilding the release.

Source builds require Go 1.27.1. Cross-compilation is not runtime acceptance for
every architecture. The Windows notification implementation retains its MIT
license alongside OC's Apache-2.0 license and upstream notices. The manifest
records identity, not a signature or attestation.

Start with the documentation index
for verified installation steps and current operational guidance.

---

OC 客户端可靠性与发布更新

本次包含 Git 标签 RELEASE.2026-10-07T04-39-33Z 之后的变化。该标签是源码比较基线，
不能作为 GitHub 附件已经发布的证明。新版本沿用 OtterIO 的 UTC 时间戳标签格式。

本次变化

• 修复 Windows 通知解码、空闲句柄释放、异步取消缓冲区生命周期和重复监听。
  保留竞态及 checkptr 检查，真正的事件丢失仍会触发镜像同步恢复。
• 处理 Windows 长文件名、操作系统阻止的暂存目录替换和不支持的文件属性；
  周期镜像恢复等待扫描与复制工作结束后再更新共享状态。
• 加固配置导入、端点验证和配置缓存访问，保持单行 JSON 错误、结构化类别及可用时的错误代码，
  修复实时镜像过滤与事件处理。
• 在日期运算和复制前验证对象锁保留期限，拒绝超出可表示日历范围的日期，
  保留清除保留配置的请求和公开接口。
• 更新 Go 漏洞扫描器，分片进度观察采用既有传输期限，继续保留取消、吞吐和残留会话检查。
• 新增时间戳标签二进制发布：要求同一源码的 main 检查成功，构建 11 个平台归档，
  附带 SHA-256 校验文件、源码身份清单与许可证；草稿附件逐个下载比对后再发布。
• 发布 Linux amd64/arm64 容器镜像到 GHCR，并可选发布到 Docker Hub。
  镜像使用发布归档中的同一可执行文件，推送后按摘要验证，再发布 GitHub 版本，
  并把镜像摘要写入清单。版本标签禁止覆盖，最新已发布稳定版本单独按摘要提升为 latest，
  验证后再更新 GitHub 的最新版本标记。
• 将继承的安装与支持说明改为按任务组织的 OC 中英文文档，覆盖安装、容器、配置、传输、
  迁移、管理和排错。补齐命令、兼容、安全、开发与维护指南；带日期的验收记录继续保留，
  并链接当前操作说明。

升级与兼容性

Go 模块路径仍为 github.com/soulteary/mc，OtterIO SDK 仍固定为
v0.0.0-20261004215341-be8596f0d69d，兼容性测试服务端应用已记录的三个补丁。
本次不扩大为所有历史 OtterIO 或第三方 S3 均兼容的承诺，具体范围见
兼容性清单和当前验收范围。

OC 使用独立配置目录。导入 mc 配置前先备份；导入在验证和私有备份后替换目标别名。
OC_* 优先于继续支持的旧 MC_* 设置。MinIO 自更新与 SUBNET 上传保持禁用。
使用经过校验的发布附件替换可执行文件，并检查 oc --version；Windows 使用 oc.exe。
部署前验证别名、TLS、复制与镜像过滤、对象锁操作。通知没有持久化重放游标。

选择发布清单中包含 images 的版本；包括 RELEASE.2026-10-07T14-10-00Z 在内的纯归档版本，
清单没有容器镜像身份记录。容器镜像使用 ghcr.io/soulteary/oc:<release-tag>，挂载 /root/.oc 保留配置。
部署时固定版本标签或清单中的摘要；latest 是会移动的别名。Docker Hub 发布需要同时配置
仓库 Actions secrets DOCKERHUB_USERNAME 和 DOCKERHUB_TOKEN。
版本镜像只推送了一部分时，必须使用新的发布标签；仅 latest 更新失败时，
可以通过 Stable release promotion 重试，无需重新构建或发布该版本。

源码构建要求 Go 1.27.1；交叉编译不能代替全部架构的运行验收。
归档同时保留 OC 的 Apache-2.0 许可证、上游声明和 Windows 通知实现的 MIT 许可证。
身份清单不是签名或供应链证明。

从文档目录查看已核对的安装步骤及当前操作说明。

OC RELEASE.2026-10-07T14-10-00Z

OC client reliability and release update

This update includes the changes after Git tag RELEASE.2026-10-07T04-39-33Z.
That tag is a source baseline; it does not establish that GitHub release assets
were published. The release uses OtterIO's UTC timestamp tag format.

Changes

• Fix Windows notification decoding without weakening race/checkptr checks.
  Preserve asynchronous read buffers until cancellation completes, close idle
  handles, and keep old completions from removing replacement watches. Report
  genuine event loss so live mirrors reconcile their state.
• Handle Windows filename limits, OS-blocked staging-directory replacement and
  unsupported filesystem attributes. Synchronize periodic mirror recovery with
  scan/copy worker shutdown.
• Harden configuration import, endpoint validation and configuration cache access.
  Keep JSON errors on one line with stable error codes/categories. Correct live
  mirror filtering and event handling.
• Validate object-lock durations and calendar bounds before arithmetic or copying
  data. Reject out-of-range retention dates before data transfer; retain supported
  clear requests and public interfaces.
• Update the Go vulnerability scanner for Go 1.27 and use the existing transfer
  deadline when observing throttled multipart progress. Keep cancellation,
  throughput and residual-session assertions.
• Add timestamp-based binary publication with exact-source main CI checks,
  eleven platform archives, SHA-256 checksums, source identity and licenses.
  Upload to a stable draft and verify every downloaded asset before publication.

Compatibility and upgrade

The module path remains github.com/soulteary/mc. The OtterIO SDK remains pinned
to v0.0.0-20261004215341-be8596f0d69d; the compatibility fixture applies the
three recorded server patches. This release does not claim compatibility with
all historical OtterIO versions or every third-party S3 service.
See the compatibility manifest and
validation scope.

OC uses its own configuration directory. Back up configuration before importing
from mc; import replaces destination aliases after validation and a private backup.
OC_* settings take precedence over supported legacy MC_* settings.
MinIO self-update and SUBNET upload remain disabled. Replace the executable using
verified release assets and check oc --version; the Windows archive contains
oc.exe. Test aliases, TLS, copy/mirror filters and object-lock operations before
rollout. Notifications have no durable replay cursor.

Source builds require Go 1.27.1. Cross-compilation is not runtime acceptance for
every architecture. The Windows notification implementation retains its MIT
license alongside OC's Apache-2.0 license and upstream notices. The manifest
records identity, not a signature or attestation.

---

OC 客户端可靠性与发布更新

本次包含 Git 标签 RELEASE.2026-10-07T04-39-33Z 之后的变化。该标签是源码比较基线，
不能作为 GitHub 附件已经发布的证明。新版本沿用 OtterIO 的 UTC 时间戳标签格式。

本次变化

• 修复 Windows 通知解码、空闲句柄释放、异步取消缓冲区生命周期和重复监听。
  保留竞态及 checkptr 检查，真正的事件丢失仍会触发镜像同步恢复。
• 处理 Windows 长文件名、操作系统阻止的暂存目录替换和不支持的文件属性；
  周期镜像恢复等待扫描与复制工作结束后再更新共享状态。
• 加固配置导入、端点验证和配置缓存访问，保持单行 JSON 错误及稳定的错误代码/类别，
  修复实时镜像过滤与事件处理。
• 在日期运算和复制前验证对象锁保留期限，拒绝超出可表示日历范围的日期，
  保留清除保留配置的请求和公开接口。
• 更新 Go 漏洞扫描器，分片进度观察采用既有传输期限，继续保留取消、吞吐和残留会话检查。
• 新增时间戳标签二进制发布：要求同一源码的 main 检查成功，构建 11 个平台归档，
  附带 SHA-256 校验文件、源码身份清单与许可证；草稿附件逐个下载比对后再发布。

升级与兼容性

Go 模块路径仍为 github.com/soulteary/mc，OtterIO SDK 仍固定为
v0.0.0-20261004215341-be8596f0d69d，兼容性测试服务端应用已记录的三个补丁。
本次不扩大为所有历史 OtterIO 或第三方 S3 均兼容的承诺，具体范围见
兼容性清单和验收范围。

OC 使用独立配置目录。导入 mc 配置前先备份；导入在验证和私有备份后替换目标别名。
OC_* 优先于继续支持的旧 MC_* 设置。MinIO 自更新与 SUBNET 上传保持禁用。
使用经过校验的发布附件替换可执行文件，并检查 oc --version；Windows 使用 oc.exe。
部署前验证别名、TLS、复制与镜像过滤、对象锁操作。通知没有持久化重放游标。

源码构建要求 Go 1.27.1；交叉编译不能代替全部架构的运行验收。
归档同时保留 OC 的 Apache-2.0 许可证、上游声明和 Windows 通知实现的 MIT 许可证。
身份清单不是签名或供应链证明。