diff --git a/README.md b/README.md
index 19106c28..3935b738 100644
--- a/README.md
+++ b/README.md
@@ -6,15 +6,15 @@ This repository contains the bilingual documentation for **Silo**, a community f
 
 ## Release state and publication
 
-Current releases: **mcli 20261109**, **SILO Server and KES 20261026**,
-**SILO Console v2.6.0**, and **silo-pkg v3.16.0**. All use Go 1.27.3.
-The standalone mcli release adopts pkg v3.16.0; existing Server and Console
-artifacts retain their embedded client and package versions. KES is an
-optional external key service.
+Current releases: **SILO Server and mcli 20261109**, **SILO Console v2.7.0**,
+**silo-pkg v3.16.0**, and **KES 20261026**. All use Go 1.27.3.
+Server 20261109 embeds Console 2.7.0, mcli 20261109 and pkg v3.16.0.
+KES remains a separate, optional external key service.
 
 | Release notes | English | 简体中文 |
 | --- | --- | --- |
-| Console 2.7.0 (unreleased draft) | [Release draft](content/blog/release/console-2.7.0.md) | [发布草稿](content/blog/release/console-2.7.0.zh.md) |
+| Server 20261109 | [Release notes](content/blog/release/silo-20261109.md) | [发布说明](content/blog/release/silo-20261109.zh.md) |
+| Console 2.7.0 | [Release notes](content/blog/release/console-2.7.0.md) | [发布说明](content/blog/release/console-2.7.0.zh.md) |
 | Console 2.6.0 | [Release notes](content/blog/release/console-2.6.0.md) | [发布说明](content/blog/release/console-2.6.0.zh.md) |
 | mcli 20261109 | [Release notes](content/blog/release/mcli-20261109.md) | [发布说明](content/blog/release/mcli-20261109.zh.md) |
 | silo-pkg 3.16.0 | [Release notes](content/blog/release/pkg-3.16.0.md) | [发布说明](content/blog/release/pkg-3.16.0.zh.md) |
@@ -25,11 +25,10 @@ optional external key service.
 See the [component matrix](content/compatibility/versions.md) for exact sources,
 upgrade order and compatibility boundaries.
 
-Console 2.7.0 documents the merged ten-language UI, Arabic RTL and container
-fixes. Its tag and Draft Release have passed validation. The public release notes
-record the exact source, CI and image digest, and distinguish the unpublished
-GitHub draft from a product release. Published Console downloads
-continue to use 2.6.0. Server 20261026 still embeds Console 2.5.1.
+Server 20261109 adds lifecycle, restore, Object Lock and batch authorization
+repairs. Read its upgrade notes before mixing versions or rolling back batch
+jobs. Console 2.7.0 is published independently and embedded in this Server
+release; older Server binaries retain their original UI and dependencies.
 
 `data/releases.yaml` drives the homepage and download templates.
 `server.published: true` enables public asset links; `published_server` records
diff --git a/README_ZH.md b/README_ZH.md
index 0f13d9ab..733397c6 100644
--- a/README_ZH.md
+++ b/README_ZH.md
@@ -6,11 +6,12 @@
 
 ## 当前版本
 
-当前版本为 **mcli 20261109**、**SILO Server 与 KES 20261026**、**SILO Console v2.6.0** 和 **silo-pkg v3.16.0**，均使用 Go 1.27.3。独立 mcli 已采用 pkg v3.16.0；既有 Server 与 Console 制品保留各自内嵌的客户端及包版本。KES 是可选的外部密钥服务。
+当前版本为 **SILO Server 与 mcli 20261109**、**SILO Console v2.7.0**、**silo-pkg v3.16.0** 与 **KES 20261026**，均使用 Go 1.27.3。Server 20261109 内嵌 Console 2.7.0、mcli 20261109 与 pkg v3.16.0；KES 保持独立、可选的外部密钥服务。
 
 | 发布说明 | English | 简体中文 |
 | --- | --- | --- |
-| Console 2.7.0（未发布草稿） | [Release draft](content/blog/release/console-2.7.0.md) | [发布草稿](content/blog/release/console-2.7.0.zh.md) |
+| Server 20261109 | [Release notes](content/blog/release/silo-20261109.md) | [发布说明](content/blog/release/silo-20261109.zh.md) |
+| Console 2.7.0 | [Release notes](content/blog/release/console-2.7.0.md) | [发布说明](content/blog/release/console-2.7.0.zh.md) |
 | Console 2.6.0 | [Release notes](content/blog/release/console-2.6.0.md) | [发布说明](content/blog/release/console-2.6.0.zh.md) |
 | mcli 20261109 | [Release notes](content/blog/release/mcli-20261109.md) | [发布说明](content/blog/release/mcli-20261109.zh.md) |
 | silo-pkg 3.16.0 | [Release notes](content/blog/release/pkg-3.16.0.md) | [发布说明](content/blog/release/pkg-3.16.0.zh.md) |
@@ -20,7 +21,7 @@
 
 精确源码版本、升级顺序与兼容性边界见[组件矩阵](content/compatibility/versions.zh.md)。
 
-Console 2.7.0 记录已合入主线的十语言界面、阿拉伯语 RTL 和容器修复。标签与 Draft Release 已通过验证，公开版本说明记录准确源码、CI 和镜像摘要，并区分尚未公开发布的 GitHub 草稿与产品正式版；正式下载继续指向 2.6.0。Server 20261026 仍内嵌 Console 2.5.1。
+Server 20261109 交付生命周期、恢复、Object Lock 与批处理授权修复。混合版本或回退 batch 作业前，请先阅读升级说明。Console 2.7.0 已独立发布，也内嵌于本次 Server；旧 Server 二进制仍保留各自原有的界面与依赖。
 
 `data/releases.yaml` 驱动首页与下载页。`server.published: true` 启用公开制品下载链接，`published_server` 记录当前公开版本。准备后续候选版本时保持 false，直到相应 Server 制品与 Docker 镜像公开且完成核验。`windows_archive_format` 跟随各组件实际发布制品：当前 Windows 归档统一为 ZIP，Linux/macOS 保持 tar.gz；历史下载链接保留原格式。制品发布与具体生产集群部署分别验收。
 
diff --git a/content/about/security-advisories.md b/content/about/security-advisories.md
index 8db0e9c6..d46a5942 100644
--- a/content/about/security-advisories.md
+++ b/content/about/security-advisories.md
@@ -14,7 +14,7 @@ Entries with a public CVE use that identifier. Because upstream `minio/minio` is
 
 ## Current Release Boundary {#boundary}
 
-The current production baseline is **[Server 20261026](/blog/release/silo-20261026/)** (with embedded **[Console v2.5.1](/blog/release/console-2.5.1/)** and **[silo-pkg v3.15.2](/blog/release/pkg-3.15.2/)**), standalone **[Console v2.6.0](/blog/release/console-2.6.0/)**, **[mcli 20261109](/blog/release/mcli-20261109/)**, and **[silo-pkg v3.16.0](/blog/release/pkg-3.16.0/)**, all built with Go 1.27.3. **[KES 20261026](/blog/release/silo-20261026/#kes)** is the optional external key service. These releases retain the earlier security fixes below and add the [dependency security updates](/blog/release/silo-20261026/#runtime-fixes). The first fixed versions remain:
+The current production baseline is **[Server 20261109](/blog/release/silo-20261109/)**, with embedded and standalone **[Console 2.7.0](/blog/release/console-2.7.0/)**, **[mcli 20261109](/blog/release/mcli-20261109/)** and **[silo-pkg 3.16.0](/blog/release/pkg-3.16.0/)**, built with Go 1.27.3. **[KES 20261026](/blog/release/silo-20261026/#kes)** remains optional. Server 20261109 adds bulk/replicated Object Lock deletion protection and batch authorization controls; follow its [coordinated upgrade requirements](/blog/release/silo-20261109/#upgrade). It retains the earlier security fixes below. Their first fixed versions remain:
 
 - **Server 20261018** fixes [SN-2026-015](#sn-2026-015) (`PutObjectRetention` governance bypass), [SN-2026-016](#sn-2026-016) (version-addressed and in-place Object Lock overwrites), and [SN-2026-017](#sn-2026-017) (Admin credential authorization boundaries), and adds scoped STS token revocation (`0cd388c66`). Server 20260916 and earlier remain affected by `SN-2026-015` through `SN-2026-017`; deploy the upgrade to every Server node and replication peer accepting writes. See the [October security note](/blog/security/20261018-release-hardening/) and [Component Version Matrix](/compatibility/versions/).
 - **Server 20260916** and **Console v2.4.1** include [SN-2026-011](#sn-2026-011) through [SN-2026-014](#sn-2026-014), which are absent from Server 20260903.
diff --git a/content/about/security-advisories.zh.md b/content/about/security-advisories.zh.md
index fe8efda4..b22989b5 100644
--- a/content/about/security-advisories.zh.md
+++ b/content/about/security-advisories.zh.md
@@ -14,7 +14,7 @@ icon: fa-solid fa-shield-halved
 
 ## 当前发布边界 {#boundary}
 
-当前生产推荐基线为 **[Server 20261026](/zh/blog/release/silo-20261026/)**（内嵌 **[Console v2.5.1](/zh/blog/release/console-2.5.1/)** 与 **[silo-pkg v3.15.2](/zh/blog/release/pkg-3.15.2/)**）、独立版 **[Console v2.6.0](/zh/blog/release/console-2.6.0/)**、**[mcli 20261109](/zh/blog/release/mcli-20261109/)** 与 **[silo-pkg v3.16.0](/zh/blog/release/pkg-3.16.0/)**，均使用 Go 1.27.3；可选的外部密钥服务为 **[KES 20261026](/zh/blog/release/silo-20261026/#kes)**。当前版本保留以下历史安全修复，并纳入[依赖安全更新](/zh/blog/release/silo-20261026/#runtime-fixes)。各问题首次修复的版本如下：
+当前生产推荐基线为 **[Server 20261109](/zh/blog/release/silo-20261109/)**，配套内嵌与独立 **[Console 2.7.0](/zh/blog/release/console-2.7.0/)**、**[mcli 20261109](/zh/blog/release/mcli-20261109/)** 和 **[silo-pkg 3.16.0](/zh/blog/release/pkg-3.16.0/)**，使用 Go 1.27.3；**[KES 20261026](/zh/blog/release/silo-20261026/#kes)** 保持可选。Server 20261109 新增批量／复制删除的 Object Lock 保护与批处理授权控制，请按[协同升级要求](/zh/blog/release/silo-20261109/#upgrade)实施。此前安全修复继续保留，其首次修复版本如下：
 
 - **Server 20261018** 修复了 [SN-2026-015](#sn-2026-015)（`PutObjectRetention` 治理保留期授权绕过）、[SN-2026-016](#sn-2026-016)（指定版本与原地写入覆写对象锁）以及 [SN-2026-017](#sn-2026-017)（委派 IAM Admin 凭据授权边界），并新增按主体/按令牌范围吊销 STS 会话的能力（`0cd388c66`）。Server 20260916 及更早版本仍受 `SN-2026-015` 至 `SN-2026-017` 影响；请将修复部署至每一个接受写入的 Server 节点与复制站点。详见[十月安全公告](/zh/blog/security/20261018-release-hardening/)与[组件版本矩阵](/zh/compatibility/versions/)。
 - **Server 20260916** 与 **Console v2.4.1** 包含 [SN-2026-011](#sn-2026-011) 至 [SN-2026-014](#sn-2026-014) 的修复（Server 20260903 不包含）。
diff --git a/content/blog/release/silo-20261026.md b/content/blog/release/silo-20261026.md
index 7832cdb0..376ca56b 100644
--- a/content/blog/release/silo-20261026.md
+++ b/content/blog/release/silo-20261026.md
@@ -21,7 +21,7 @@ aliases:
 **SILO, mcli, and PGSTY KES 20261026 are now released**, alongside **[SILO Console 2.5.1](/blog/release/console-2.5.1/)** and **[silo-pkg 3.15.2](/blog/release/pkg-3.15.2/)**. This article consolidates the October 24–25 maintenance records and summarizes all changes since the **20261018** release. All three executables share the same release date and package version; KES remains an optional, independently deployed key encryption service.
 
 > [!NOTE]
-> Subsequent standalone releases ship **[mcli 20261109](/blog/release/mcli-20261109/)**, **[Console 2.6.0](/blog/release/console-2.6.0/)**, and **[silo-pkg 3.16.0](/blog/release/pkg-3.16.0/)**. Additional post-`20261026` Server maintenance repairs are merged on `main` and await the next Server release; see the [Server compatibility page](/compatibility/server/#post-20261026) and [component matrix](/compatibility/versions/).
+> [Server 20261109](/blog/release/silo-20261109/) now delivers the subsequent maintenance repairs, with **Console 2.7.0**, **mcli 20261109** and **silo-pkg 3.16.0**. KES remains at 20261026. See the [component matrix](/compatibility/versions/) and the new release’s upgrade requirements.
 
 ## Released components {#scope}
 
diff --git a/content/blog/release/silo-20261026.zh.md b/content/blog/release/silo-20261026.zh.md
index 0a5b4082..0590c07b 100644
--- a/content/blog/release/silo-20261026.zh.md
+++ b/content/blog/release/silo-20261026.zh.md
@@ -21,7 +21,7 @@ aliases:
 **SILO、mcli 与 PGSTY KES 20261026 现已联合发布**，配套 **[SILO Console 2.5.1](/zh/blog/release/console-2.5.1/)** 与 **[silo-pkg 3.15.2](/zh/blog/release/pkg-3.15.2/)**。本文整合了 10 月 24—25 日的维护记录，完整说明自 **20261018** 正式版以来的所有变更。三个可执行组件采用统一的发布日期与包版本号；KES 仍作为可选的外部密钥服务独立部署。
 
 > [!NOTE]
-> 此后独立发布的组件版本包括 **[mcli 20261109](/zh/blog/release/mcli-20261109/)**、**[Console 2.6.0](/zh/blog/release/console-2.6.0/)** 与 **[silo-pkg 3.16.0](/zh/blog/release/pkg-3.16.0/)**。`20261026` 之后的 Server 维护修复已合入 `main` 分支，待下一版 Server 正式交付；详见[服务端兼容性说明](/zh/compatibility/server/#post-20261026)与[组件矩阵](/zh/compatibility/versions/)。
+> 后续维护修复已由 [Server 20261109](/zh/blog/release/silo-20261109/) 正式交付，配套 **Console 2.7.0**、**mcli 20261109** 与 **silo-pkg 3.16.0**。KES 保持 20261026；详见[组件矩阵](/zh/compatibility/versions/)和新版升级要求。
 
 ## 发布组件 {#scope}
 
diff --git a/content/blog/release/silo-20261109.md b/content/blog/release/silo-20261109.md
new file mode 100644
index 00000000..d6d59abf
--- /dev/null
+++ b/content/blog/release/silo-20261109.md
@@ -0,0 +1,60 @@
+---
+title: "SILO 20261109: lifecycle, Object Lock and batch authorization"
+linkTitle: "SILO 20261109"
+date: 2026-11-09
+author: "SILO"
+description: "Server maintenance since 20261026, with Console 2.7.0, mcli 20261109 and silo-pkg 3.16.0."
+tags: [Release, Security, Storage, Console]
+weight: 1
+draft: false
+url: "/blog/release/silo-20261109/"
+---
+
+SILO Server **20261109** brings the maintenance work since 20261026 into one release: safer multi-pool lifecycle and tier cleanup, two-phase native restore, stronger Object Lock checks, and batch jobs bound to the submitter's current permissions. It embeds **Console 2.7.0**, **mcli 20261109** and **silo-pkg 3.16.0**.
+
+[GitHub release](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-11-09T00-00-00Z) · [Full changelog](https://github.com/pgsty/silo/blob/d998292387ccf1d2907749e0fb1575ef5fb93fda/CHANGELOG.md) · [Upgrade guide](/operations/deployments/baremetal-upgrade-minio-deployment/) · [Downloads](/download/)
+
+## Components {#components}
+
+| Component | Version | Source |
+| --- | --- | --- |
+| SILO Server | `RELEASE.2026-11-09T00-00-00Z` | `d998292387ccf1d2907749e0fb1575ef5fb93fda` |
+| Embedded Console | [2.7.0](/blog/release/console-2.7.0/) | `4e91ae506e70` |
+| mcli | [20261109](/blog/release/mcli-20261109/) | `e1d4cc5abfe0` |
+| silo-pkg | [3.16.0](/blog/release/pkg-3.16.0/) | `b7aeea85e84e` |
+| Go / minio-go | Go 1.27.3 / pinned upstream SDK | `v7.4.2-0.20261025165926-320af050c445` |
+{.wide .expand}
+
+The server package version is `20261109000000.0.0`. KES remains the separate, optional 20261026 release. Updating a standalone Console or client does not replace components embedded in an older Server binary. The maintained PGSTY stack is the supported combination; upstream MinIO/MC compatibility remains best effort.
+
+## Storage and recovery {#storage}
+
+- **Lifecycle across pools:** evaluate expiry under the object lock using authoritative version history and protection from every pool. Refuse incomplete histories and protected whole-key deletions; exact-key deletion no longer reaches child keys. Decommission and rebalance move versions that cannot safely expire.
+- **Remote tiers:** retain remote data while another pool still references it. Exclude free versions from ordinary version history, expire restored copies without deleting the underlying object, and account only for actual removals.
+- **Native restore:** download tier data outside the object write lock, then validate ownership before publishing it. Failed or canceled attempts try marker cleanup for 100 ms before bounded background retries, avoiding a one-minute synchronous lock wait.
+- **Locking and conditional writes:** align single-pool mutations with their erasure-set lock, fix CopyObject lock ordering and starvation, and evaluate multi-pool multipart initiation conditions against the current object. Ordinary bulk deletion groups can run concurrently across sets.
+- **Reads and healing:** return retryable errors for known partial disk views, classify metadata checksum failures for healing, preserve data during heal dry runs, and remove empty directories after failed writes.
+
+## Object Lock, IAM and jobs {#authorization}
+
+S3 `DeleteObjects` now checks physical version removals inside the same lock used for retention and legal-hold updates, including protection held by another pool's copy. Directory null versions are protected as well. Replicated purges honor the target's Object Lock; a source GOVERNANCE bypass does not grant a bypass at the target, so such replication can remain failed and retry.
+
+Batch expiration and key rotation enforce the authenticated submitter's local data permissions during execution. Revoked or changed identities end the job; unavailable IAM or authorization dependencies pause it with a recorded reason and bounded retry. Startup discovery retries storage outages, completed jobs remain completed, and replication jobs can resume their scans. Use `mcli batch status` to distinguish completion, refusal, failure and pause. External authorization plugins must return a successful HTTP status with an explicit boolean decision (`result` or `result.allow`); absent/null decisions, trailing JSON and responses over 1 MiB are rejected, and each call is bounded by one minute. Verify custom plugins before upgrading.
+
+IAM edits operate on persisted records so stale caches cannot restore old credentials or deleted identities. The release also fixes long-DN LDAP login on erasure sets, embedded Console root login with LDAP enabled, and webhook target reloads across peers. Console 2.7.0 adds ten UI languages and fixes usage-worker TLS/budgets, plain-HTTP folder-size and key-copy actions, and malformed uploads.
+
+## Upgrade and rollback {#upgrade}
+
+1. **Stop batch submissions before changing versions.** Drain or cancel all running, pending and paused jobs. Unfinished legacy jobs require resubmission after every node upgrades; completed jobs do not. New submitter-bound manifests and reports use formats that 20261026 rejects. Do not downgrade with unfinished new jobs or expect old executors to resume them. Follow the [batch checklist](/administration/batch-framework/#upgrade-20261109).
+2. **Drain incompatible single-pool layouts.** If the sets do not all share the same hosts (normally 18 or more hosts with automatic layout), stop every old process before starting new ones. Old and new lock domains do not safely support rolling upgrades for this layout.
+3. **Pause restores during mixed versions.** New nodes return `503` to `POST ?restore` while any peer is old or unreachable. Full multi-pool lifecycle and bulk Object Lock protection requires all serving nodes to be upgraded.
+4. **Verify real S3 access after restarting.** `ready` remains a process/configured-dependency probe. Even `cluster` can succeed while a node reconnects remote drives. Use bounded signed writes and readback through every node before resuming applications; preserve peer bootstrap and Kubernetes `publishNotReadyAddresses`. See [health checks](/operations/monitoring/healthcheck-probe/#native-probe).
+5. **Pin the Helm image.** Chart 7.0.4 defaults to this release. `helm upgrade --reuse-values` retains the stored tag, so explicitly set `image.tag=RELEASE.2026-11-09T00-00-00Z`.
+
+## Costs and limits {#limits}
+
+Safety checks deliberately read more metadata and may refuse work that cannot be proven safe. Multipart initiation can hold its object lock longer; multi-pool expiry reads and reconciles history. Object Lock bucket version purges in a bulk request now use the single-object path sequentially, so large purge batches take longer. Ordinary buckets and marker creation retain the bulk path. In a bounded Linux ARM64 two-pool check, the average per-round median for 1,000 removable locked-bucket versions increased from about 202 ms to 310 ms. This is an intentional safety cost, not a production throughput estimate. Steady HEAD/GET medians changed by about +1.5%/+3.4%; the earlier macOS read slowdown did not reproduce in the Linux steady-state read check. Durable-write timings varied even when the same binary was compared with itself. On the same data directories and key set, three alternating rounds measured about +2.1% for 4 KiB overwrite and −8% for 1 MiB overwrite/new PUT medians; tmpfs and OS-call traces showed no matching request-path work increase. These measurements do not promise unchanged write tail latency on production storage.
+
+Lifecycle-created deletions are not replicated. Known limitations remain in multipart-upload listing ([#79](https://github.com/pgsty/silo/issues/79)), multi-site delete-marker purge ([#217](https://github.com/pgsty/silo/issues/217)), replayed bucket creation ([#241](https://github.com/pgsty/silo/pull/241)), and tag-only authorization returning `403` when an object cannot be read ([#293](https://github.com/pgsty/silo/issues/293)). The pinned upstream SDK can drop conditional headers at multipart completion, so `mcli put --if-not-exists` is not a guarantee against overwrites throughout a multipart upload. These limits are not resolved by upgrading.
+
+Release acceptance covers the exact source's Go/race and packaging gates, two-pool and four-node runtime checks, S3/client/Console compatibility, and upgrade/rollback of the exercised object and IAM data. Local performance measurements use Linux ARM64 in a VM with directory-backed drives; they do not establish production disk or cross-host capacity, nor do these bounded checks constitute a long-duration soak test. Verify the workload and topology used by your deployment.
diff --git a/content/blog/release/silo-20261109.zh.md b/content/blog/release/silo-20261109.zh.md
new file mode 100644
index 00000000..2eee8d4f
--- /dev/null
+++ b/content/blog/release/silo-20261109.zh.md
@@ -0,0 +1,60 @@
+---
+title: "SILO 20261109：生命周期、对象锁与批处理授权"
+linkTitle: "SILO 20261109"
+date: 2026-11-09
+author: "SILO"
+description: "20261026 之后的服务端维护发布，内嵌 Console 2.7.0、mcli 20261109 与 silo-pkg 3.16.0。"
+tags: [Release, Security, Storage, Console]
+weight: 1
+draft: false
+url: "/zh/blog/release/silo-20261109/"
+---
+
+SILO Server **20261109** 汇集了 20261026 之后的维护改动：多池生命周期与远端分层清理、两阶段原生恢复、Object Lock 保护，以及绑定提交者当前权限的批处理作业。该版本内嵌 **Console 2.7.0**、**mcli 20261109** 与 **silo-pkg 3.16.0**。
+
+[GitHub 发布](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-11-09T00-00-00Z) · [完整变更记录](https://github.com/pgsty/silo/blob/d998292387ccf1d2907749e0fb1575ef5fb93fda/CHANGELOG.md) · [升级指南](/zh/operations/deployments/baremetal-upgrade-minio-deployment/) · [下载](/zh/download/)
+
+## 组件 {#components}
+
+| 组件 | 版本 | 源码 |
+| --- | --- | --- |
+| SILO Server | `RELEASE.2026-11-09T00-00-00Z` | `d998292387ccf1d2907749e0fb1575ef5fb93fda` |
+| 内嵌 Console | [2.7.0](/zh/blog/release/console-2.7.0/) | `4e91ae506e70` |
+| mcli | [20261109](/zh/blog/release/mcli-20261109/) | `e1d4cc5abfe0` |
+| silo-pkg | [3.16.0](/zh/blog/release/pkg-3.16.0/) | `b7aeea85e84e` |
+| Go / minio-go | Go 1.27.3 / 固定上游 SDK | `v7.4.2-0.20261025165926-320af050c445` |
+{.wide .expand}
+
+服务端软件包版本为 `20261109000000.0.0`。KES 保持独立、可选的 20261026 版本。单独升级 Console 或客户端不会替换旧 Server 二进制内嵌的组件。正式支持维护的 PGSTY 组件组合，对上游 MinIO/MC 尽最大努力兼容。
+
+## 存储与恢复 {#storage}
+
+- **多池生命周期：** 在对象锁内，结合所有池的权威版本历史和保护状态决定过期；历史不完整或存在受保护版本时拒绝整键删除。精确键删除不再涉及子键。Decommission 与 rebalance 会迁移无法安全过期的版本。
+- **远端分层：** 只要其他池仍引用远端数据就保留它；普通版本历史排除 free version，已恢复副本到期时只清本地副本，不删底层对象，并只统计实际发生的移除。
+- **原生恢复：** 下载远端数据时释放对象写锁，发布前再验证本次恢复的所有权。失败或取消后先尝试 100 毫秒清理标记，再转为有界后台重试，避免同步等待对象锁约一分钟。
+- **锁与条件写入：** 单池修改统一使用对象所属纠删集的锁；修复 CopyObject 的锁顺序和饥饿问题；多池分片上传的发起条件按当前对象求值。普通批量删除的不同 set 分组可并发执行。
+- **读取与自愈：** 已知磁盘视图不完整时返回可重试错误；将元数据校验和错误归类供自愈处理；heal dry run 保留数据，并清除失败写入留下的空目录。
+
+## 对象锁、IAM 与作业 {#authorization}
+
+S3 `DeleteObjects` 现在使用与保留期、法律保留更新相同的锁，在锁内检查物理版本清除，并合并其他池副本的保护状态。目录对象的 null 版本同样受保护。复制删除遵守目标端 Object Lock；源端绕过 GOVERNANCE 不会赋予目标端绕过权限，因此此类复制可能持续失败并重试。
+
+批量过期和密钥轮换在执行期间持续检查经过认证的提交者是否拥有本地数据权限。身份撤销或发生绑定变化会终止作业；IAM 或授权依赖暂时不可用则暂停，记录原因并有界重试。启动发现会重试存储故障，已完成作业保持完成，复制作业可以恢复扫描。使用 `mcli batch status` 区分完成、拒绝、失败与暂停。外部授权插件必须返回成功 HTTP 状态与显式布尔决定（`result` 或 `result.allow`）；缺失／null 决定、尾随 JSON 及超过 1MiB 的响应会被拒绝，每次调用上限为一分钟。升级前请验证自定义插件。
+
+IAM 基于持久记录执行编辑，避免陈旧缓存恢复旧凭据或已删除身份。此版本还修复了纠删集上的长 DN LDAP 登录、启用 LDAP 时内嵌 Console 的 root 登录，以及各节点的 webhook 目标重载。Console 2.7.0 提供十种界面语言，并修复用量后台任务的 TLS 与预算、普通 HTTP 下的目录大小与密钥复制，以及格式错误的上传请求。
+
+## 升级与回退 {#upgrade}
+
+1. **切换版本前停止提交 batch 作业。** 排空或取消运行、等待、暂停中的全部作业。旧格式未完成作业在全部节点升级后需重交；已完成作业无需重交。新绑定清单与进度报告使用 20261026 拒绝的格式。仍有新作业未完成时不要降级，也不要期望旧执行器续跑。按[批处理清单](/zh/administration/batch-framework/#upgrade-20261109)操作。
+2. **不兼容的单池布局必须排空重启。** 如果各 set 不全位于同一组主机上（自动布局通常为 18 台及以上），先停止所有旧进程，再启动新版。此布局的旧、新锁域不能安全滚动混用。
+3. **混合版本期间暂停新恢复。** 只要还有旧节点或不可达节点，新节点对 `POST ?restore` 返回 `503`。多池生命周期和批量 Object Lock 的完整保护也需要全部服务节点升级。
+4. **重启后验证实际 S3 访问。** `ready` 保持进程与已配置依赖的探针语义；`cluster` 成功时，节点仍可能在重连远端磁盘。恢复应用前，执行有界的逐节点签名写入、回读检查；保持节点发现与 Kubernetes `publishNotReadyAddresses`。详见[健康检查](/zh/operations/monitoring/healthcheck-probe/#native-probe)。
+5. **固定 Helm 镜像。** Chart 7.0.4 默认使用此版本。`helm upgrade --reuse-values` 会保留已有标签，因此显式设置 `image.tag=RELEASE.2026-11-09T00-00-00Z`。
+
+## 代价与限制 {#limits}
+
+安全检查有意增加元数据读取，并拒绝无法证明安全的操作。分片上传发起时可能持有对象锁更久，多池过期需要读取和合并历史。Object Lock 桶中，批量请求的物理版本清除逐项走单对象路径，大批量清除会更慢；普通桶和创建删除标记仍走批量路径。有界 Linux ARM64 双池测试中，1000 个可删除版本的每轮中位数均值约从 202ms 增至 310ms。这是有意承担的安全成本，不是生产吞吐估计。稳态 HEAD／GET 中位数约变化 +1.5%／+3.4%，此前 macOS 上的读取变慢没有在 Linux 稳态读测试中重现。持久化写入在同一二进制自身对比中也出现明显波动。固定数据目录与键集合、交替三轮后，4KiB 覆盖写中位数约 +2.1%，1MiB 覆盖／新建写约 −8%；tmpfs 与底层调用追踪没有显示同量级请求路径开销增加。这些测量不承诺生产存储上的写入尾延迟保持不变。
+
+生命周期产生的删除不复制。已知限制仍包括分片上传列表（[#79](https://github.com/pgsty/silo/issues/79)）、多站点删除标记清除（[#217](https://github.com/pgsty/silo/issues/217)）、重放创建桶（[#241](https://github.com/pgsty/silo/pull/241)），以及仅按对象标签授权时、对象不可读导致返回 `403`（[#293](https://github.com/pgsty/silo/issues/293)）。固定的上游 SDK 在完成分片上传时可能丢失条件头，因此 `mcli put --if-not-exists` 不能保证整个分片上传期间都不会覆盖。升级不会解决这些限制。
+
+发布验收覆盖精确源码的 Go/race 和打包门禁、双池与四节点运行、S3/客户端/Console 兼容，以及已测对象和 IAM 数据的升级回退。本地性能测试使用 Linux ARM64 虚拟机和目录模拟的数据盘，不代表生产磁盘或跨主机容量；这些有界测试也不构成长时间稳定性压测。上线前仍需验证自身拓扑与负载。
diff --git a/content/compatibility/_index.md b/content/compatibility/_index.md
index 209d4e44..ac59b6ac 100644
--- a/content/compatibility/_index.md
+++ b/content/compatibility/_index.md
@@ -23,7 +23,7 @@ When a condition applies, verify or adjust deployment, policies, tools or upgrad
 {{< /card >}}
 {{< /cards >}}
 
-**The current release baseline is 20261026.** This index covers source and companion-component changes since the fork and identifies when each repair first shipped. The [component matrix](/compatibility/versions/) records the current stack and fixes absent from older versions.
+**The current release baseline is 20261109.** Read the [20261109 upgrade requirements](/blog/release/silo-20261109/#upgrade) for batch-record boundaries, lock-domain rollout, mixed-version restore and S3 readiness checks. This index covers changes since the fork and identifies when each repair first shipped. The [component matrix](/compatibility/versions/) records the current stack and fixes absent from older versions.
 
 ## 20261026 release changes {#maintenance-20261026}
 
diff --git a/content/compatibility/_index.zh.md b/content/compatibility/_index.zh.md
index a920fa81..ff595c9b 100644
--- a/content/compatibility/_index.zh.md
+++ b/content/compatibility/_index.zh.md
@@ -23,7 +23,7 @@ sidebar_expanded: false
 {{< /card >}}
 {{< /cards >}}
 
-**当前发布基线为 20261026。** 本页汇总分叉以来的源码与配套组件变化，标明各项修复首次发布的版本。当前组件组合与旧版缺失的修复见[组件版本矩阵](/zh/compatibility/versions/)。
+**当前发布基线为 20261109。** 请先阅读 [20261109 升级要求](/zh/blog/release/silo-20261109/#upgrade)，核对 batch 记录边界、锁域升级、混合版本恢复与 S3 就绪检查。本页汇总分叉以来的源码与配套组件变化，标明各项修复首次发布的版本。当前组件组合与旧版缺失的修复见[组件版本矩阵](/zh/compatibility/versions/)。
 
 ## 20261026 正式版变化 {#maintenance-20261026}
 
diff --git a/content/compatibility/migration.md b/content/compatibility/migration.md
index 49f28532..2b5ee614 100644
--- a/content/compatibility/migration.md
+++ b/content/compatibility/migration.md
@@ -10,7 +10,7 @@ icon: fa-solid fa-arrow-right-arrow-left
 
 Migrating from MinIO to Silo reuses existing object data volumes in place without an object-by-object export and import. **Ordinary S3 applications require no code changes; administrators only need to verify deployment settings, authorization rules, and state compatibility.**
 
-The current published target is **Server 20261026** (review its [upgrade requirements](/blog/release/silo-20261026/#upgrade) and [October compatibility delta](/compatibility/server/#october-2026), especially if your deployment used `strict` multipart listing). Check the applicable [O01–O08 conditions](/compatibility/#conditional) in the [three-level compatibility overview](/compatibility/) before following this guide. RPM/DEB installations are covered in [Native Package Migration](/compatibility/binary/), and component pairings are listed in the [version matrix](/compatibility/versions/).
+The current published target is **Server 20261109**. Review its [upgrade requirements](/blog/release/silo-20261109/#upgrade), including batch jobs, lock domains, mixed-version restore and per-node S3 readiness. The [October compatibility delta](/compatibility/server/#october-2026) still applies, especially if your deployment used `strict` multipart listing. Check the applicable [O01–O08 conditions](/compatibility/#conditional) in the [three-level compatibility overview](/compatibility/) before following this guide. RPM/DEB installations are covered in [Native Package Migration](/compatibility/binary/), and component pairings are listed in the [version matrix](/compatibility/versions/).
 
 ## What changes {#scope}
 
diff --git a/content/compatibility/migration.zh.md b/content/compatibility/migration.zh.md
index 7d2ac1f9..f55e1994 100644
--- a/content/compatibility/migration.zh.md
+++ b/content/compatibility/migration.zh.md
@@ -10,7 +10,7 @@ icon: fa-solid fa-arrow-right-arrow-left
 
 从 MinIO 迁移到 Silo 可直接复用现有对象数据卷，无需逐对象导出与重新导入。**普通 S3 应用无需修改代码，管理员只需核对部署配置、权限规则与状态兼容性。**
 
-当前最新发布目标为 **Server 20261026**（升级前请一并核对其[升级要求](/zh/blog/release/silo-20261026/#upgrade)与[十月兼容性增量](/zh/compatibility/server/#october-2026)，尤其是曾启用 `strict` 分片列举的部署）。建议先对照[三档兼容性总览](/zh/compatibility/)中的 [O01–O08](/zh/compatibility/#conditional) 筛选适用条件，再执行本页步骤。RPM/DEB 软件包升级见[原生软件包迁移](/zh/compatibility/binary/)，版本配套关系见[组件矩阵](/zh/compatibility/versions/)。
+当前最新发布目标为 **Server 20261109**。升级前请核对其[升级要求](/zh/blog/release/silo-20261109/#upgrade)，包括 batch 作业、锁域、混合版本恢复与逐节点 S3 就绪检查。[十月兼容性增量](/zh/compatibility/server/#october-2026)仍然适用，尤其是曾启用 `strict` 分片列举的部署。建议先对照[三档兼容性总览](/zh/compatibility/)中的 [O01–O08](/zh/compatibility/#conditional) 筛选适用条件，再执行本页步骤。RPM/DEB 软件包升级见[原生软件包迁移](/zh/compatibility/binary/)，版本配套关系见[组件矩阵](/zh/compatibility/versions/)。
 
 ## 哪些改变 {#scope}
 
diff --git a/content/compatibility/server.md b/content/compatibility/server.md
index 2a8f7945..a0327768 100644
--- a/content/compatibility/server.md
+++ b/content/compatibility/server.md
@@ -16,9 +16,9 @@ icon: fa-solid fa-server
 
 <span id="maintenance-20261025"></span>
 
-## Candidate work after Server 20261026 {#post-20261026}
+## Server 20261109 {#post-20261026}
 
-Server 20261026 remains the published Server release. These links collect design and upgrade records for subsequent candidate work. Each record's status, source commit and validation scope apply separately; inclusion in this index does not establish release acceptance. Independently released Console and mcli versions do not add these changes to older Server artifacts.
+The [Server 20261109 release](/blog/release/silo-20261109/), source `d998292387ccf1d2907749e0fb1575ef5fb93fda`, delivers these maintenance changes. Read the release's batch, lock-domain, restore and readiness upgrade requirements first. The design records below retain their own historical source and validation scope. Independently released Console and mcli versions do not add Server changes to older binaries.
 
 | Area | Design and upgrade references |
 | --- | --- |
diff --git a/content/compatibility/server.zh.md b/content/compatibility/server.zh.md
index b0c9fbc1..7e05beae 100644
--- a/content/compatibility/server.zh.md
+++ b/content/compatibility/server.zh.md
@@ -15,9 +15,9 @@ icon: fa-solid fa-server
 
 <span id="maintenance-20261025"></span>
 
-## Server 20261026 之后的候选工作 {#post-20261026}
+## Server 20261109 {#post-20261026}
 
-Server 20261026 仍是正式服务端版本。以下索引汇总后续候选工作的设计与升级说明；每篇记录中的状态、源码提交和验收范围分别生效，不能将整个列表理解为已通过发版验收。Console 与 mcli 独立发布，不会使旧 Server 制品获得这些改动。
+[Server 20261109 正式版](/zh/blog/release/silo-20261109/)（源码 `d998292387ccf1d2907749e0fb1575ef5fb93fda`）交付了这些维护改动。请先阅读发布说明中的 batch、锁域、恢复与就绪检查升级要求。下列设计记录保留各自的历史源码与验收范围；Console 和 mcli 独立发布不会使旧 Server 二进制获得服务端改动。
 
 | 范围 | 设计与升级说明 |
 | --- | --- |
diff --git a/content/compatibility/versions.md b/content/compatibility/versions.md
index bda0c6bd..22654052 100644
--- a/content/compatibility/versions.md
+++ b/content/compatibility/versions.md
@@ -9,7 +9,19 @@ page_width: wide
 icon: fa-solid fa-code-branch
 ---
 
-SILO 20261026 is the current Server release, with embedded Console 2.5.1, mcli 20261026 and silo-pkg 3.15.2. The latest standalone client is **mcli 20261109**. KES 20261026 is a separate, optional external key service. The maintained PGSTY stack is supported; upstream MinIO/MC compatibility is best effort.
+SILO **20261109** is the current Server release, with embedded Console 2.7.0, mcli 20261109 and silo-pkg 3.16.0. KES 20261026 is a separate, optional external key service. The maintained PGSTY stack is supported; upstream MinIO/MC compatibility is best effort.
+
+## Server 20261109 {#server-20261109}
+
+| Component | Released version | Fixed source |
+| --- | --- | --- |
+| Server | `RELEASE.2026-11-09T00-00-00Z` | `d998292387ccf1d2907749e0fb1575ef5fb93fda` |
+| Embedded Console | `v2.7.0` | `4e91ae506e706ccdecb512b1d8b5ab4d9871d505` |
+| mcli / MC module | `RELEASE.2026-11-09T00-00-00Z` | `e1d4cc5abfe00b674eb36347399e7398990be467` |
+| Shared package | `github.com/pgsty/silo-pkg/v3 v3.16.0` | `b7aeea85e84e8888d6ab424c7123a1297711bc3f` |
+{.wide .expand}
+
+The Server package version is `20261109000000.0.0`. Go 1.27.3 and upstream minio-go `v7.4.2-0.20261025165926-320af050c445` remain unchanged. [Release and upgrade notes](/blog/release/silo-20261109/) cover batch format boundaries, mixed-version restore, lock-domain rollout and per-node S3 readiness checks. Ordinary object/IAM rollback checks do not imply that old workers can resume new batch records.
 
 ## Standalone Console {#console}
 
@@ -23,8 +35,7 @@ release (`v0.0.0-20261109021353-e1d4cc5abfe0`).
 [2.6.0](/blog/release/console-2.6.0/) (source
 `f8ab146695fd1df74e4b84128a286d552921bf00`) added usage scans,
 retained-version totals and bucket-administration fixes.
-Server 20261026 continues to embed Console 2.5.1 until a
-separate Server release adopts newer source.
+Server 20261109 embeds Console 2.7.0; historical Server 20261026 retains Console 2.5.1.
 
 ## mcli 20261109 {#mcli-20261109}
 
@@ -263,7 +274,7 @@ is separate from the maintained policy implementation.
 
 Console v2.4.2, mcli 20261018 and the Server 20261018 release use Go **1.27.2**; the September stack used Go **1.27.1**.
 The pkg v3.14.x line retains a Go **1.26** library floor and was race-tested with Go **1.26.8**.
-Server 20261026, standalone Console v2.5.1 and v2.6.0, mcli 20261026 and 20261109, and pkg v3.15.2 and v3.16.0 require Go **1.27.3**. The Go x/* dependencies were refreshed.
+Server 20261026 and 20261109, standalone Console v2.5.1 through v2.7.0, mcli 20261026 and 20261109, and pkg v3.15.2 and v3.16.0 require Go **1.27.3**. The Go x/* dependencies were refreshed.
 The effective go-systemd version stays **v22.6.0** because v22.7.0 fails to compile
 on NetBSD; Console's tablewriter **v0.0.5** replacement preserves its MC API.
 
diff --git a/content/compatibility/versions.zh.md b/content/compatibility/versions.zh.md
index 15dd0853..183a8f21 100644
--- a/content/compatibility/versions.zh.md
+++ b/content/compatibility/versions.zh.md
@@ -9,7 +9,19 @@ page_width: wide
 icon: fa-solid fa-code-branch
 ---
 
-SILO 20261026 是当前正式服务端版本，内嵌 Console 2.5.1、mcli 20261026 与 silo-pkg 3.15.2。最新独立客户端为 **mcli 20261109**。KES 20261026 是独立、可选的外部密钥服务。正式支持维护的 PGSTY 组件组合，对原厂 MinIO/MC 尽最大努力兼容。
+SILO **20261109** 是当前正式服务端版本，内嵌 Console 2.7.0、mcli 20261109 与 silo-pkg 3.16.0。KES 20261026 是独立、可选的外部密钥服务。正式支持维护的 PGSTY 组件组合，对原厂 MinIO/MC 尽最大努力兼容。
+
+## Server 20261109 {#server-20261109}
+
+| 组件 | 正式版本 | 固定源码 |
+| --- | --- | --- |
+| Server | `RELEASE.2026-11-09T00-00-00Z` | `d998292387ccf1d2907749e0fb1575ef5fb93fda` |
+| 内嵌 Console | `v2.7.0` | `4e91ae506e706ccdecb512b1d8b5ab4d9871d505` |
+| mcli / MC 模块 | `RELEASE.2026-11-09T00-00-00Z` | `e1d4cc5abfe00b674eb36347399e7398990be467` |
+| 公共包 | `github.com/pgsty/silo-pkg/v3 v3.16.0` | `b7aeea85e84e8888d6ab424c7123a1297711bc3f` |
+{.wide .expand}
+
+Server 包版本为 `20261109000000.0.0`，Go 1.27.3 与上游 minio-go `v7.4.2-0.20261025165926-320af050c445` 保持不变。[发布与升级说明](/zh/blog/release/silo-20261109/)记录 batch 格式边界、混合版本恢复、锁域升级与逐节点 S3 就绪检查。普通对象／IAM 回退验证不代表旧 worker 能续跑新格式 batch 记录。
 
 ## 独立 Console {#console}
 
@@ -20,7 +32,7 @@ SILO 20261026 是当前正式服务端版本，内嵌 Console 2.5.1、mcli 20261
 该版本加入十种界面语言、阿拉伯语 RTL、容器 CA／临时目录修复，以及用量后台任务、普通 HTTP 与上传修复，
 使用 Go 1.27.3、silo-pkg v3.16.0 与正式 mcli 20261109（Go 伪版本 `v0.0.0-20261109021353-e1d4cc5abfe0`）。
 [2.6.0](/zh/blog/release/console-2.6.0/)（源码 `f8ab146695fd1df74e4b84128a286d552921bf00`）加入了用量扫描、保留版本统计与存储桶管理修复。
-Server 20261026 仍内嵌 Console 2.5.1，采用新版源码需要单独发布 Server。
+Server 20261109 内嵌 Console 2.7.0；历史 Server 20261026 保留 Console 2.5.1。
 
 ## mcli 20261109 {#mcli-20261109}
 
@@ -180,7 +192,7 @@ Go 不继承依赖模块的 `replace`。即使 Console 已选择 MC，Server 仍
 Console 和 MC 保留历史 MinIO 模块路径，pkg 直接使用自己的路径。
 `colorjson`/`dperf` 带入的旧 `minio/pkg/v3` 传递依赖与维护中的策略实现相互独立。
 
-Console v2.4.2、mcli 20261018 与 Server 20261018 使用 Go **1.27.2**，9 月版栈使用 Go **1.27.1**；pkg v3.14.x 系列保留 Go **1.26** 库兼容下限，并通过 Go **1.26.8** race 测试。Server 20261026、独立发布的 Console v2.5.1 与 v2.6.0、mcli 20261026 与 20261109，以及 pkg v3.15.2 与 v3.16.0 均要求 Go **1.27.3**。
+Console v2.4.2、mcli 20261018 与 Server 20261018 使用 Go **1.27.2**，9 月版栈使用 Go **1.27.1**；pkg v3.14.x 系列保留 Go **1.26** 库兼容下限，并通过 Go **1.26.8** race 测试。Server 20261026 与 20261109、独立发布的 Console v2.5.1 至 v2.7.0、mcli 20261026 与 20261109，以及 pkg v3.15.2 与 v3.16.0 均要求 Go **1.27.3**。
 Go x/* 依赖已刷新。go-systemd 实际仍选 **v22.6.0**，因为 v22.7.0 在 NetBSD 编译失败；
 Console 保留 tablewriter **v0.0.5** replacement 以兼容所用 MC API。
 
diff --git a/content/operations/replication/iam-upgrade.md b/content/operations/replication/iam-upgrade.md
index bb9a8130..e48d18da 100644
--- a/content/operations/replication/iam-upgrade.md
+++ b/content/operations/replication/iam-upgrade.md
@@ -6,7 +6,7 @@ weight: 25
 icon: fa-solid fa-user-shield
 ---
 
-**The current upgrade target is [Server 20261026](/blog/release/silo-20261026/).** The 20260916/20261018 revocation-history and authorization requirements below still apply. This release also repairs long-DN LDAP login, policy reloads and built-in policy Reset. Coordinate all participating nodes using the [component matrix](/compatibility/versions/).
+**The current upgrade target is [Server 20261109](/blog/release/silo-20261109/).** The 20260916/20261018 revocation-history and authorization requirements below still apply. Server 20261109 edits persisted IAM records and adds batch submitter authorization; drain or cancel unfinished batch jobs before upgrading, following the [batch checklist](/administration/batch-framework/#upgrade-20261109). Coordinate every participating node using the [component matrix](/compatibility/versions/).
 
 **STS revocation verification:** 20261018 also adds [durable enumeration and propagation](/blog/design/iam-revocations/#scoped-sts-20261018). After revoking the actual parent/token type, check old-token rejection and fresh-token validity at every node and site, including a reconnecting peer. Tokens never received from an isolated site are outside the requesting cluster snapshot; one successful response does not establish instantaneous global invalidation during a partition.
 
diff --git a/content/operations/replication/iam-upgrade.zh.md b/content/operations/replication/iam-upgrade.zh.md
index 03fa7466..016ca5d5 100644
--- a/content/operations/replication/iam-upgrade.zh.md
+++ b/content/operations/replication/iam-upgrade.zh.md
@@ -6,7 +6,7 @@ weight: 25
 icon: fa-solid fa-user-shield
 ---
 
-**当前升级目标为 [Server 20261026](/zh/blog/release/silo-20261026/)。** 下述 20260916／20261018 的撤销历史与授权要求继续适用；本版另包含长 DN LDAP 登录、策略重载及内置策略 Reset 修复。按[组件矩阵](/zh/compatibility/versions/)协调升级所有参与节点。
+**当前升级目标为 [Server 20261109](/zh/blog/release/silo-20261109/)。** 下述 20260916／20261018 撤销历史与授权要求继续适用。Server 20261109 基于持久 IAM 记录编辑，并加入 batch 提交者授权；升级前按[批处理清单](/zh/administration/batch-framework/#upgrade-20261109)排空或取消未完成作业。按[组件矩阵](/zh/compatibility/versions/)协调所有参与节点。
 
 **STS 撤销验证：**20261018 同时补齐[持久枚举与撤销传播](/zh/blog/design/iam-revocations/#scoped-sts-20261018)。用实际父身份／令牌类型撤销后，逐个节点与站点确认旧令牌被拒绝、新令牌仍可用，并覆盖离线节点重连。请求集群未曾收到的孤立站点令牌不在撤销快照中；不要据一次成功响应推断分区中的全局瞬时失效。
 
diff --git a/content/reference/s3-api-compatibility.md b/content/reference/s3-api-compatibility.md
index 059ced4b..7e443378 100644
--- a/content/reference/s3-api-compatibility.md
+++ b/content/reference/s3-api-compatibility.md
@@ -7,7 +7,7 @@ upstream_link: https://github.com/minio/docs/blob/35f2bb81280a3573c64947e8bd979e
 upstream_modified: true
 ---
 
-**SILO 20261026 contract:** This page retains the inherited S3 API catalog. The target is the [20261026 release](/blog/release/silo-20261026/). Apply the documented limits and error behavior for [ordinary LIST](/blog/design/listing-recovery-lock-cost/), [Object Lock](/blog/security/20260926-governance-retention-bypass/) and [multipart listing](/blog/design/list-multipart-uploads/#implementation). Checksum message text can change; see the [checksum contract](/blog/design/complete-multipart-checksum-errors/#october-errors).
+**SILO 20261109 contract:** This page retains the inherited S3 API catalog. The target is [Server 20261109](/blog/release/silo-20261109/), including locked bulk-version deletion and current-object multipart conditions. Apply the documented limits and error behavior for [ordinary LIST](/blog/design/listing-recovery-lock-cost/), [Object Lock](/blog/release/silo-20261109/#authorization) and [multipart listing](/blog/design/list-multipart-uploads/#implementation). Checksum message text can change; see the [checksum contract](/blog/design/complete-multipart-checksum-errors/#october-errors).
 
 <a id="s3-api-compatibility"></a>
 
diff --git a/content/reference/s3-api-compatibility.zh.md b/content/reference/s3-api-compatibility.zh.md
index 19c107a8..9372fdec 100644
--- a/content/reference/s3-api-compatibility.zh.md
+++ b/content/reference/s3-api-compatibility.zh.md
@@ -7,7 +7,7 @@ upstream_link: https://github.com/minio/docs/blob/35f2bb81280a3573c64947e8bd979e
 upstream_modified: true
 ---
 
-**SILO 20261026 契约：** 本页继承 S3 API 目录，当前目标为 [20261026 正式版](/zh/blog/release/silo-20261026/)。[普通 LIST](/zh/blog/design/listing-recovery-lock-cost/)、[Object Lock](/zh/blog/security/20260926-governance-retention-bypass/)和[分片列表](/zh/blog/design/list-multipart-uploads/#implementation)的限定与错误行为以这些记录为准。校验和消息可能改变，错误码契约见[校验和说明](/zh/blog/design/complete-multipart-checksum-errors/#october-errors)。
+**SILO 20261109 契约：** 本页继承 S3 API 目录，当前目标为 [Server 20261109](/zh/blog/release/silo-20261109/)，包括持锁批量版本清除和按当前对象求值的分片条件。[普通 LIST](/zh/blog/design/listing-recovery-lock-cost/)、[Object Lock](/zh/blog/release/silo-20261109/#authorization) 和[分片列表](/zh/blog/design/list-multipart-uploads/#implementation)仍有文档列出的限定与错误行为。校验和消息可能改变，错误码契约见[校验和说明](/zh/blog/design/complete-multipart-checksum-errors/#october-errors)。
 
 <a id="s3-api"></a>
 
diff --git a/data/home/metrics.yaml b/data/home/metrics.yaml
index 11126274..96a7823c 100644
--- a/data/home/metrics.yaml
+++ b/data/home/metrics.yaml
@@ -1,7 +1,7 @@
 # Remote counters; refresh with: bin/metrics.py
 # docker_pulls sums pgsty/minio (archived, pre-rename) and pgsty/silo.
-github_stars: 4591
-docker_pulls: 7406135
+github_stars: 4593
+docker_pulls: 7422094
 
 # Security inventory verified on 2026-10-24; release count is fetched by bin/metrics.py.
 # security_fixes: unique CVE/SN entries in /about/security-advisories/#advisories;
@@ -9,4 +9,4 @@ docker_pulls: 7406135
 # releases: published pgsty/silo Server releases; excludes drafts and prereleases.
 # Homepage Security Notes / Release Notes cards count their section pages instead.
 security_fixes: 25
-releases: 13
+releases: 14
diff --git a/data/releases.yaml b/data/releases.yaml
index bbd57a94..97966846 100644
--- a/data/releases.yaml
+++ b/data/releases.yaml
@@ -2,17 +2,17 @@
 # Keep the Windows format tied to each published version. Switch a component
 # to zip only when its new Windows assets have been published and verified.
 server:
-  tag: RELEASE.2026-10-26T00-00-00Z
-  build: 20261026000000.0.0
-  date: "2026-10-26"
+  tag: RELEASE.2026-11-09T00-00-00Z
+  build: 20261109000000.0.0
+  date: "2026-11-09"
   published: true
   go_version: "1.27.3"
   windows_archive_format: zip
-  source: c3ad836aed0d8a7d23c2e44a5eaa3009d08525e3
+  source: d998292387ccf1d2907749e0fb1575ef5fb93fda
 published_server:
-  tag: RELEASE.2026-10-26T00-00-00Z
-  build: 20261026000000.0.0
-  date: "2026-10-26"
+  tag: RELEASE.2026-11-09T00-00-00Z
+  build: 20261109000000.0.0
+  date: "2026-11-09"
 client:
   tag: RELEASE.2026-11-09T00-00-00Z
   go_version: "1.27.3"