Object Lock Retention Bypass and Version-Overwrite Repair Design (SN-2026-015 / SN-2026-016)

Status on 2026-10-15: The complete repair in PR #234 (14042b5aa) and PR #235 (0d3ba5d4c) first shipped in RELEASE.2026-10-15T00-00-00Z. The previously published RELEASE.2026-09-16T00-00-00Z remains affected. See the advisory and release notes for upgrade requirements and artifact acceptance.

This document records the verification, Git provenance, repair design, critical-path evaluation, and adversarial candidate trade-offs for two Object Lock (WORM) security vulnerabilities identified through external reports and an internal write-path audit: SN-2026-015 (PutObjectRetention bypass header authorization and condition-key short-circuit) and SN-2026-016 (version-addressed write overwrite bypass and write-path lock gaps).

Companion public security advisory:

• SN-2026-015 / SN-2026-016: Object Lock Retention Authorization Bypass and Versioned Write Overwrite

1. Problem Verification and External Report Cross-Check

1.1 Two Independent External Reports and Internal Audit

This repair addresses two independent external vulnerability reports alongside an internal audit of adjacent write paths:

1. Initial Report (F2 primary path): Privately reported by security researcher szopi00 via GitHub Security Advisory (GHSA-67mv-7hc9-wj88), showing that a principal holding s3:PutObjectRetention without s3:BypassGovernanceRetention could shorten unexpired GOVERNANCE retention by sending x-amz-bypass-governance-retention: true.
2. Independent External Report (F1 / F2 / F3): A separate external report independently reproduced three attack paths: unauthorized changes from GOVERNANCE to multi-year COMPLIANCE, bypasses of request-body condition-key Deny policies on s3:PutObjectRetention, and shortening unexpired GOVERNANCE retention without bypass authorization.
3. Internal Companion Audit (SN-2026-016 / F4 and directory null-version overwrites): Auditing all write paths for callers holding s3:PutObject without bypass permission uncovered three related gaps: in-place overwrites via ?versionId= without replication trust (putOpts), implicit null-version overwrites on directory keys (dir/), and completion of persisted multipart uploads (CompleteMultipartUpload).

1.2 Claim-by-Claim Verification of the Independent Report

The following findings and line numbers refer to the pre-fix bcb5fc956 snapshot:

2. Vulnerability Breakdown and Git Provenance

2.1 SN-2026-015: PutObjectRetention Authorization Short-Circuit (F1 / F2 / F3)

Before the fix, PUT /{bucket}/{object}?retention suffered from two structural defects:

1. Signature-only check at handler entry: PutObjectRetentionHandler called authenticateRequest(ctx, r, policy.PutObjectRetentionAction), which verifies request authentication (signature/token) without evaluating IAM policies;
2. Conflated bypass check and inverted boolean logic: Inside enforceRetentionBypassForPut and isPutRetentionAllowed, the server trusted the raw header x-amz-bypass-governance-retention: true and combined bypass permission with base retention permission using logical OR (byPassSet || retSet).

This produced three distinct authorization failures (F1–F3) plus a day-count arithmetic bug when clearing retention:

Exact Git Commit Provenance

1. Correct initial design (Nov 2019 – Mar 2020):
   • ca96560d5 (2019-11-20, Poorna Krishnamoorthy), f931fc7bf (2019-11-25), and #9030 (97cbac604, 2020-03-04): PutObjectRetentionHandler enforced checkRequestAuthType for s3:PutObjectRetention at entry and evaluated s3:BypassGovernanceRetention via IAM before passing the authorization boolean into enforceRetentionBypassForPut.
2. Defect introduction (Apr 2020 — upstream #9259, 43a3778b4, 2020-04-06, Harshavardhana):
   • To support the three XML body condition keys (s3:object-lock-mode, s3:object-lock-retain-until-date, s3:object-lock-remaining-retention-days), this commit removed checkRequestAuthType at handler entry and pushed policy evaluation into isPutRetentionAllowed inside enforceRetentionBypassForPut, introducing three bugs at once:
     • enforceRetentionBypassForPut checked the raw header if !byPassSet;
     • isPutRetentionAllowed only evaluated IAM when retMode == objectlock.RetGovernance && byPassSet, leaving byPassSet == true for COMPLIANCE;
     • isPutRetentionAllowed concluded with if byPassSet || retSet { return ErrNone }.
3. Expansion to empty <Retention/> clear requests (May 2020 — upstream #9677, bede525dc, 2020-05-22, Ashish Kumar Sinha):
   • Allowed clearing GOVERNANCE retention via an empty <Retention/> body (Mode == ""), which also took the retMode != RetGovernance branch and introduced the 106,752-day zero-date calculation bug.
4. Partial fix in Feb 2025 and mechanical regression in Apr 2025:
   • Upstream #20929 (437dd4e32, 2025-02-12, Ramon de Klein) added an unconditional checkRequestAuthType(ctx, r, policy.PutObjectRetentionAction, bucket, object) at handler entry, masking F1 (while breaking condition-key Allow policies and leaving F2/F3 open).
   • Just 50 days later, upstream #21103 (8c7097528, 2025-04-03, Harshavardhana) mechanically replaced checkRequestAuthType with signature-only authenticateRequest while keeping the stale // Check permissions to perform this object retention operation comment, reopening F1. SILO forked after this commit and inherited all three flaws.

2.2 SN-2026-016: Version-Addressed Write Overwrite Bypass and Write-Path Lock Gaps

In standard S3 semantics, public write APIs (PutObject, CopyObject, CreateMultipartUpload, PostPolicy) never allow callers to specify a target versionId to overwrite an existing version in place. Three related write-path flaws broke this invariant:

Exact Git Commit Provenance

1. May 2020 — GOVERNANCE omitted from checkPutObjectLockAllowed (upstream #9513, 9b3b04ece, 2020-05-04): checkPutObjectLockAllowed only blocked unexpired COMPLIANCE and LegalHoldOn in if opts.VersionID != "" && !replicaTrusted, omitting GOVERNANCE and ignoring non-nil errors from getObjectInfoFn.
2. Sep 2020 — Unauthenticated ?versionId= accepted in putOpts (upstream #10598, 56d1b227c, 2020-09-30, Poorna Krishnamoorthy): putOpts accepted ?versionId= from the query string to support replication without checking trustedReplication.
3. May 2023 — Directory objects forced to nullVersionID (upstream #17132, 1d0211d39, 2023-05-04, Harshavardhana): putOpts and delOpts forced opts.VersionID = nullVersionID for isDirObject(object) without updating checkPutObjectLockAllowed or the storage commit path.

3. Final Repair Plan: What Code Changes and How

The final repair combines Core Plan A (SN-2026-015) with Entry + Storage Write-Lock Defense-in-Depth + Fail-Closed Preflight (SN-2026-016) across 11 production files under cmd/:

3.1 SN-2026-015 Detailed Code Changes (Core Plan A)

(1) cmd/object-handlers.go: Unconditional Base Authorization at PutObjectRetentionHandler Entry

Immediately after authenticateRequest and ParseObjectRetention(r.Body)—and before GetBucketInfo, globalBucketObjectLockSys.Get, or getOpts—enforce s3:PutObjectRetention via isRetentionActionAllowed:

// cmd/object-handlers.go: PutObjectRetentionHandler
objRetention, err := objectlock.ParseObjectRetention(r.Body)
if err != nil {
	apiErr := errorCodes.ToAPIErr(ErrMalformedXML)
	apiErr.Description = err.Error()
	writeErrorResponse(ctx, w, apiErr, r.URL)
	return
}

reqInfo := logger.GetReqInfo(ctx)
reqInfo.SetTags("retention", objRetention.String())

// Check permissions to perform this object retention operation. The
// object-lock condition keys come from the request body, so this is
// decided before any bucket or object state is read.
if !isRetentionActionAllowed(policy.PutObjectRetentionAction, bucket, object, objRetention, r, reqInfo.Cred, reqInfo.Owner) {
	writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrAccessDenied), r.URL)
	return
}

(2) cmd/bucket-object-lock.go: isRetentionActionAllowed and enforceRetentionBypassForPut

isRetentionActionAllowed constructs object-lock-mode, object-lock-retain-until-date, and object-lock-remaining-retention-days from the parsed request body and calls globalIAMSys.IsAllowed:

• When clearing retention (empty <Retention/>, zero RetainUntilDate) or for non-future dates, object-lock-remaining-retention-days is set to "0" (fixing the 106,752-day bug caused by time.Duration clamping and math.Abs, while keeping the key present so NumericLessThan Deny policies match clear requests);
• For future dates, ceiling days are computed from Unix seconds and nanoseconds to avoid 292-year time.Duration saturation.

Inside the object write lock, enforceRetentionBypassForPut evaluates only stored retention state:

// cmd/bucket-object-lock.go
func isRetentionActionAllowed(action policy.Action, bucketName, objectName string, objRetention *objectlock.ObjectRetention, r *http.Request, cred auth.Credentials, owner bool) bool {
	if objRetention == nil {
		return false
	}
	t, err := objectlock.UTCNowNTP()
	if err != nil {
		internalLogIf(r.Context(), err, logger.WarningKind)
		return false
	}

	conditionValues := getConditionValues(r, "", cred.AccessKey, nil)
	conditionValues["object-lock-mode"] = []string{string(objRetention.Mode)}
	conditionValues["object-lock-retain-until-date"] = []string{objRetention.RetainUntilDate.Format(time.RFC3339)}

	var days int64
	if !objRetention.RetainUntilDate.IsZero() && objRetention.RetainUntilDate.After(t) {
		sec := objRetention.RetainUntilDate.Unix() - t.Unix()
		nsec := int64(objRetention.RetainUntilDate.Nanosecond() - t.Nanosecond())
		if nsec < 0 {
			sec--
			nsec += int64(time.Second)
		}
		days = sec / (24 * 60 * 60)
		if sec%(24*60*60) > 0 || nsec > 0 {
			days++
		}
	}
	conditionValues["object-lock-remaining-retention-days"] = []string{strconv.FormatInt(days, 10)}

	return globalIAMSys.IsAllowed(policy.Args{
		AccountName:     cred.AccessKey,
		Groups:          cred.Groups,
		Action:          action,
		BucketName:      bucketName,
		ConditionValues: conditionValues,
		IsOwner:         owner,
		ObjectName:      objectName,
		Claims:          cred.GetClaims(),
	})
}

func enforceRetentionBypassForPut(ctx context.Context, r *http.Request, oi ObjectInfo, objRetention *objectlock.ObjectRetention, cred auth.Credentials, owner bool) error {
	ret := objectlock.GetObjectRetentionMeta(oi.UserDefined)
	if !ret.Mode.Valid() {
		return nil
	}
	t, err := objectlock.UTCNowNTP()
	if err != nil {
		internalLogIf(ctx, err, logger.WarningKind)
		return ObjectLocked{Bucket: oi.Bucket, Object: oi.Name, VersionID: oi.VersionID}
	}
	if ret.RetainUntilDate.Before(t) {
		return nil
	}

	weakens := objRetention.Mode != ret.Mode || objRetention.RetainUntilDate.Before(ret.RetainUntilDate.Time)
	if !weakens {
		return nil
	}
	switch ret.Mode {
	case objectlock.RetGovernance:
		if !objectlock.IsObjectLockGovernanceBypassSet(r.Header) {
			return ObjectLocked{Bucket: oi.Bucket, Object: oi.Name, VersionID: oi.VersionID}
		}
		if !isRetentionActionAllowed(policy.BypassGovernanceRetentionAction, oi.Bucket, oi.Name, objRetention, r, cred, owner) {
			return errAuthentication
		}
		return nil
	default:
		return ObjectLocked{Bucket: oi.Bucket, Object: oi.Name, VersionID: oi.VersionID}
	}
}

(3) cmd/auth-handler.go: Remove isPutRetentionAllowed

Delete the 45-line isPutRetentionAllowed function from cmd/auth-handler.go, eliminating the byPassSet || retSet short-circuit.

3.2 SN-2026-016 Detailed Code Changes (Entry Guards + Write-Lock Re-Checks + Fail-Closed Preflight)

Why must SN-2026-016 retain storage write-lock checks in addition to HTTP entry guards and preflight checks? Four concrete scenarios cannot be prevented by entry or provenance markers alone:

1. Slow-body PUT dir/ TOCTOU race (TestPlanReviewSlowDirectoryPut): In PutObjectHandler, checkPutObjectLockAllowed runs before streaming r.Body to disk, whereas the namespace write lock (er.NewNSLock) is acquired only after r.Body finishes streaming to a temporary file. A writer with s3:PutObject can initiate PUT /bucket/dir/, pass preflight while dir/ is unlocked, pause streaming the request body while an administrator applies COMPLIANCE retention (200 OK), and then finish sending the body. Without re-checking under er.NewNSLock, the paused PUT overwrites the null version and erases the committed COMPLIANCE lock.
2. Pre-existing or replication-initiated persisted uploadId completion (TestPlanReviewLegacyMPUCompliance): putOpts runs only during NewMultipartUpload; CompleteMultipartUpload uses completeMultipartOpts and takes the target fi.VersionID from .minio.sys/multipart/.../uploadID/xl.meta. For any upload created before the upgrade (or initiated by a replication principal), completing the upload after the target UUID version is locked under COMPLIANCE requires no concurrency and only s3:PutObject unless CompleteMultipartUpload validates the target under the write lock.
3. Recovered multipart staging state colliding with a replicated COMPLIANCE version (TestRecoveredMultipartUploadAfterReplica): Even when a multipart upload’s fi.VersionID was originally generated by the server at NewMultipartUpload time, if an older multipart staging snapshot is restored after a surviving replica has already re-synced and COMPLIANCE-locked that completed UUID version, a provenance marker only proves where the UUID came from at initiation—not that the version does not already exist at completion time. Therefore, CompleteMultipartUpload must unconditionally check under the destination write lock whether fi.VersionID already exists.
4. Fail-closed read error handling (TestPlanReviewPreflightReadFailure): Only an explicit non-existence result (ObjectNotFound, VersionNotFound, or delete marker MethodNotAllowed) may be treated as unlocked; bucket lock configuration errors or storage read quorum failures (InsufficientReadQuorum) must reject the write immediately at preflight as well as at commit time.

The four components of the SN-2026-016 repair are:

(1) Reject Untrusted versionId at the putOpts Convergence Point (cmd/object-api-options.go)

All HTTP write option builders (PutObject, CopyObject, NewMultipartUpload, PostPolicy, PutObjectExtract) converge at putOpts:

// cmd/object-api-options.go: putOpts
vid = strings.TrimSpace(vid)
// A caller-chosen version ID writes that version in place. Only trusted
// replication may recreate a source version under its original ID.
if vid != "" && !trustedReplication {
	return opts, errAuthentication
}

(2) Set the Outer Replication Marker on Batch Snowball Archives (cmd/batch-handlers.go)

When SILO’s batch replicate streams a Snowball archive via writeAsArchive to another SILO/MinIO target, each tar PAX entry carries minio.versionId. PutObjectExtractHandler requires X-Minio-Source-Replication-Request: true (markerExact) on the outer request before granting entryTrusted:

// cmd/batch-handlers.go: writeAsArchive
opts := minio.SnowballOptions{
	Opts: minio.PutObjectOptions{
		Internal: minio.AdvancedPutOptions{
			ReplicationRequest: true,
		},
	},
	InMemory: *r.Source.Snowball.InMemory,
	Compress: *r.Source.Snowball.Compress,
	SkipErrs: *r.Source.Snowball.SkipErrs,
}

(3) Enforce Fail-Closed null-Version Lock Checks at Both HTTP Preflight and Storage Write Lock (cmd/bucket-object-lock.go, cmd/erasure-object.go, cmd/erasure-server-pool.go, cmd/erasure-sets.go)

• HTTP preflight (checkPutObjectLockAllowed): Resolve nullVersionID for directory objects (isDirObject(object)), block unexpired GOVERNANCE alongside COMPLIANCE and LegalHoldOn when !replicaTrusted, and fail closed immediately on any read error other than ObjectNotFound / VersionNotFound / MethodNotAllowed:

// cmd/bucket-object-lock.go: checkPutObjectLockAllowed
if isDirObject(object) && opts.VersionID == "" {
	opts.VersionID = nullVersionID
}

if opts.VersionID != "" && !replicaTrusted {
	objInfo, err := getObjectInfoFn(ctx, bucket, object, opts)
	if err != nil {
		if !isErrObjectNotFound(err) && !isErrVersionNotFound(err) && !errors.As(err, &MethodNotAllowed{}) {
			return mode, retainDate, legalHold, toAPIErrorCode(ctx, err)
		}
	} else {
		r := objectlock.GetObjectRetentionMeta(objInfo.UserDefined)
		t, err := objectlock.UTCNowNTP()
		if err != nil {
			internalLogIf(ctx, err, logger.WarningKind)
			return mode, retainDate, legalHold, ErrObjectLocked
		}
		if (r.Mode == objectlock.RetCompliance || r.Mode == objectlock.RetGovernance) && r.RetainUntilDate.After(t) {
			return mode, retainDate, legalHold, ErrObjectLocked
		}
		mode = r.Mode
		retainDate = r.RetainUntilDate
		legalHold = objectlock.GetObjectLegalHoldMeta(objInfo.UserDefined)
		if legalHold.Status == objectlock.LegalHoldOn {
			return mode, retainDate, legalHold, ErrObjectLocked
		}
	}
}

• Storage write-lock commit (checkObjectLockedForOverwrite): Inside er.putObject, er.CopyObject, and er.CompleteMultipartUpload while holding er.NewNSLock(bucket, object), any non-replication write targeting "" or nullVersionID calls checkObjectLockedForOverwrite (using z.replicaObjectInfo across pools) and fails closed on config or read errors:

// cmd/bucket-object-lock.go: checkObjectLockedForOverwrite
func checkObjectLockedForOverwrite(ctx context.Context, bucket, object string, getObjectInfoFn GetObjectInfoFn) error {
	if isMinioMetaBucketName(bucket) {
		return nil
	}
	retentionCfg, err := globalBucketObjectLockSys.Get(bucket)
	if err != nil {
		return err
	}
	if !retentionCfg.LockEnabled {
		return nil
	}
	objInfo, err := getObjectInfoFn(ctx, bucket, object, ObjectOptions{
		VersionID:  nullVersionID,
		NoLock:     true,
		NoAuditLog: true,
	})
	if err != nil {
		if isErrObjectNotFound(err) || isErrVersionNotFound(err) || errors.As(err, &MethodNotAllowed{}) {
			return nil
		}
		return err
	}
	if objectlock.GetObjectLegalHoldMeta(objInfo.UserDefined).Status == objectlock.LegalHoldOn {
		return ObjectLocked{Bucket: bucket, Object: decodeDirObject(object), VersionID: nullVersionID}
	}
	r := objectlock.GetObjectRetentionMeta(objInfo.UserDefined)
	if r.Mode == objectlock.RetCompliance || r.Mode == objectlock.RetGovernance {
		t, err := objectlock.UTCNowNTP()
		if err != nil {
			internalLogIf(ctx, err, logger.WarningKind)
			return ObjectLocked{Bucket: bucket, Object: decodeDirObject(object), VersionID: nullVersionID}
		}
		if r.RetainUntilDate.After(t) {
			return ObjectLocked{Bucket: bucket, Object: decodeDirObject(object), VersionID: nullVersionID}
		}
	}
	return nil
}

(4) Check Persisted fi.VersionID Under the Object Write Lock in CompleteMultipartUpload (cmd/erasure-multipart.go)

Under er.NewNSLock(bucket, object), non-replication multipart completions (!opts.ReplicationRequest && !opts.ReplicaLockReconcile && !opts.DataMovement) check the persisted fi.VersionID from uploadid/xl.meta:

• If fi.VersionID == "" || fi.VersionID == nullVersionID: call checkObjectLockedForOverwrite;
• If fi.VersionID is a non-empty UUID: query getObjectInfo (or replicaObjectInfo across pools) and reject with errAuthentication (403 AccessDenied) if that version already exists on disk (including delete markers), failing closed on read errors without deleting staged parts.

// cmd/erasure-multipart.go: CompleteMultipartUpload
if !opts.ReplicationRequest && !opts.ReplicaLockReconcile && !opts.DataMovement {
	getObjectInfo := er.getObjectInfo
	if opts.replicaObjectInfo != nil {
		getObjectInfo = opts.replicaObjectInfo
	}
	if fi.VersionID == "" || fi.VersionID == nullVersionID {
		if err := checkObjectLockedForOverwrite(ctx, bucket, object, getObjectInfo); err != nil {
			return oi, toObjectErr(err, bucket, object)
		}
	} else {
		_, gerr := getObjectInfo(ctx, bucket, object, ObjectOptions{
			VersionID:        fi.VersionID,
			Versioned:        opts.Versioned,
			VersionSuspended: opts.VersionSuspended,
			NoLock:           true,
		})
		switch {
		case gerr == nil, errors.As(gerr, &MethodNotAllowed{}):
			return oi, toObjectErr(errAuthentication, bucket, object)
		case isErrVersionNotFound(gerr) || isErrObjectNotFound(gerr):
		default:
			return oi, toObjectErr(gerr, bucket, object)
		}
	}
}

4. Critical-Path and Performance Impact Analysis

5. Why It Works and Upgrade Notes

5.1 Three Core Security Invariants

1. Invariant 1: Base permission and lock condition keys must hold before any state is read (closes F1, F3, zero-date clear bypass, and existence probing)
   • All three Object Lock condition keys on PutObjectRetention derive solely from the XML request body and current time. Evaluating isRetentionActionAllowed(policy.PutObjectRetentionAction, ...) immediately after ParseObjectRetention rejects unauthorized or policy-denied requests with 403 AccessDenied before any bucket or object lookup.
2. Invariant 2: Bypass is triggered strictly by weakening an unexpired stored lock and requires both header intent and IAM permission (closes F2)
   • enforceRetentionBypassForPut runs under the object write lock and inspects stored ret.Mode and ret.RetainUntilDate. If no lock exists, the lock is expired, or !weakens, no bypass is required. When weakens == true, stored COMPLIANCE unconditionally returns 400 ObjectLocked, and stored GOVERNANCE requires both IsObjectLockGovernanceBypassSet(r.Header) and isRetentionActionAllowed(BypassGovernanceRetentionAction, ...).
3. Invariant 3: Public writes cannot overwrite an existing UUID version or a locked null version at either entry or commit, failing closed on read errors (closes F4 and companion gaps)
   • At entry, putOpts rejects any untrusted target versionId, and checkPutObjectLockAllowed fails closed immediately on locked directory null versions or read errors.
   • Under the destination write lock (NewNSLock), checkObjectLockedForOverwrite re-verifies null-version writes (closing the slow-body TOCTOU window), and CompleteMultipartUpload verifies that any non-empty fi.VersionID does not already exist on disk (closing legacy uploads, cross-principal completions, and post-recovery UUID collisions).

PutObjectRetention Decision Matrix

retOK denotes s3:PutObjectRetention allowed with the request’s lock condition keys; bypassOK denotes s3:BypassGovernanceRetention allowed with those same keys:

Write-Path Invariant Coverage

5.2 Upgrade and Compatibility Notes

Normal new-version writes, object reads, and authorized retention extensions are unchanged. Operators should note the following tightened behaviors:

1. Policies granting s3:BypassGovernanceRetention without s3:PutObjectRetention no longer allow retention writes (SN-2026-015)
   • Previous behavior: Due to byPassSet || retSet, a principal with only s3:BypassGovernanceRetention could call PutObjectRetention by including the bypass header.
   • New behavior: Returns 403 AccessDenied. Per AWS S3 semantics, s3:BypassGovernanceRetention is an additional permission when weakening governance locks; s3:PutObjectRetention is always required.
2. Unauthorized PutObjectRetention requests uniformly return 403 instead of 404 or 400 (SN-2026-015)
   • Previous behavior: Returned 404 NoSuchBucket or 400 InvalidBucketObjectLockConfiguration before checking policy.
   • New behavior: Policy evaluation runs before reading bucket state, returning 403 AccessDenied.
3. Clearing retention (empty <Retention/>) evaluates s3:object-lock-remaining-retention-days as "0" (SN-2026-015)
   • Previous behavior: Zero-time duration clamping and math.Abs produced 106,752 days, allowing clear requests to bypass minimum-retention-day policies.
   • New behavior: Evaluates to "0", enforcing minimum-retention-day policies on clear requests.
4. Non-replication requests (including root) can no longer overwrite a version in place via ?versionId= (SN-2026-016)
   • Previous behavior: Any caller with s3:PutObject could pass ?versionId=<id> on PUT, CopyObject, or NewMultipartUpload to overwrite that version in place.
   • New behavior: Returns 403 AccessDenied at putOpts unless the request is authenticated replication.
5. batch replicate to a SILO target requires s3:ReplicateObject on the target credentials (SN-2026-016)
   • Previous behavior: A target credential with only s3:PutObject had internal replication headers stripped, yet putOpts still accepted ?versionId= from the query string.
   • New behavior: Preserving source version IDs requires target replication trust (s3:ReplicateObject), matching bucket replication requirements.
6. Locked directory objects (dir/) in Object Lock buckets cannot be overwritten until lock expiry (SN-2026-016)
   • Previous behavior: Directory objects shared the null version and skipped existing-lock checks, allowing repeated PUT dir/ calls to overwrite and reset retention.
   • New behavior: Returns 400 InvalidRequest (ObjectLocked) while the directory null version holds an unexpired GOVERNANCE/COMPLIANCE retention or LegalHoldOn.
7. Separately tracked adjacent item (not bundled in this patch)
   • PostRestoreObjectHandler (archive restore) reading a snapshot before writing back metadata via CopyObject is tracked separately as an archive-restore concurrency item.

6. Adversarial Evaluation Across Candidate Designs

During design review, four candidate write-path designs were evaluated against adversarial reproducers:

Conclusion

We adopt the fe3935476 full write-lock defense + fail-closed preflight hardening as the final implementation, and incorporate all four adversarial regression tests (TestPlanReviewSlowDirectoryPut, TestPlanReviewPreflightReadFailure, TestPlanReviewLegacyMPUCompliance, and TestRecoveredMultipartUploadAfterReplica) into cmd/object-retention-overwrite_test.go.