[Vonng]

Console still selected silo-pkg v3.15.2 and the October MC release. This adopts the released November components and upgrades Swagger independently, with focused Console regression coverage and unchanged CI gates.

Three DCO-signed commits, based on main efe12ae972579972327b0d56e085fcfc8ba62923:

• 47745554ab598c76472aeb15034da12b39be2f07: require silo-pkg v3.16.0 (b7aeea85e84e8888d6ab424c7123a1297711bc3f); retain github.com/minio/mc imports and replace with github.com/pgsty/mc v0.0.0-20261109021353-e1d4cc5abfe0, the published RELEASE.2026-11-09T00-00-00Z commit e1d4cc5abfe00b674eb36347399e7398990be467. Refresh release metadata, generated replacement/credits records and English/Chinese entry-point documentation without changing v2.6.0 history.
• 77a4551e6f695f23908cbfc0a26480d0dbaac6ab: use go-swagger v0.36.7 with runtime and server-middleware v0.33.4. Regeneration changes only 50 array-context early returns to continues across 46 models. Preserve the customized server, configuration-import binder/consumer, schema and TypeScript client. Fix the existing SPA interception of /swagger.json, which prevented the generated documentation page from loading its spec.
• 53aff8bdc3182d7c78693c95403f3733f9e86588: make the existing observer-renewal regression use production defaults and synchronize with PostgreSQL lease expiry. The initial CI run failed with its unsupported 50 ms heartbeat/300 ms lease settings. Inventory is held beyond the original database deadline, renewal must remain live, and the inventory bucket and reconciliation must be persisted. No usage runtime code or CI gates change.

Dependency selection is deliberate:

Module	Before → after	Reason
silo-pkg/v3	v3.15.2 → v3.16.0	Adopt the released maintained shared package
MC replacement	0ceb298cdcd0 → e1d4cc5abfe0	Pin the released mcli 20261109 source, not floating main or pre-release 4974bb2c981b
cpuid/v2	v2.4.1 → v2.4.2	Resolved by maintained components; XSAVE/OSXSAVE detection correction
yaml/v3	v3.0.5 → v3.0.6	Resolved by maintained components; preserve literal << keys
gjson	v1.20.0 → v1.20.1	Adopt MC's tested selection; retain pretty v1.2.2 output
go-jose/v4	v4.1.6 → v4.1.9	Module graph only; absent from standalone Console's package dependency set
go-swagger	v0.36.6 → v0.36.7	Correct array context validation traversal
runtime + server-middleware	v0.33.3 → v0.33.4	Required by the generator; correct Redoc 3 ES module loading

No JOSE vulnerability fix in the standalone Console binary is claimed. Go remains 1.27.3; upstream minio-go remains v7.4.2-0.20261025165926-320af050c445; x/net remains v0.62.0 and x/crypto remains v0.58.1-0.20261009181718-2f1f834330b2. Effective tablewriter v0.0.5, runewidth v0.0.29 and go-systemd v22.6.0 replacements remain. Indirect minio/pkg is still reached through minio/colorjson and is not replaced.

gjson v1.20.2/pretty v1.3.0 are deferred because they change formatting. pgx/puddle require a separate usage/PostgreSQL assessment. pb, humanize, Prometheus, gRPC and cloud SDK updates have no demonstrated need in this change. Runtime, tool and graph-only changes are kept distinct.

Local validation passed: repeated tidy without drift, module verification, verifiers, replacement checks, structural/online dependency release verification, downstream embedder build/vet, Go unit tests, API/pkg race tests and govulncheck (no vulnerabilities found). The full PostgreSQL/SILO storage-integration suite also passed locally. A real SILO regression under the existing required job covers the MC adapter's version reads, delete markers, exact-key purge boundaries, errors and watch cancellation; diagnostics and ILM contracts are tested. Swagger generation reproduced 763 files byte-for-byte; config-import and API binder tests pass; Chromium rendered Redoc 3 and its specification without browser errors.

The observer test now uses the production two-minute lease and 15-second heartbeat, with no test-specific timing overrides. On final head, the full PostgreSQL/SILO storage suite passes with the race detector (pkg/usage: 143s, api: 46s). A temporary Go overlay disabling renewal fails at the original two-minute database expiry, confirming the regression is still detected. Repeated tidy, module verification, verifiers and Go unit tests also pass.

CI for exact head 53aff8bdc3182d7c78693c95403f3733f9e86588: Required vulnerability checks passed; Required matrix passed. All 38 matrix jobs and all 3 vulnerability workflow jobs succeeded on that exact head. Browser regression results: 886 tests passed plus 8 group-boundary tests. Final-head online verification also confirms both published dependency tags and full source commits against the public Go proxy, checksum database and go.sum.

The original uncommitted work was preserved separately; this PR used an isolated worktree. Investigation logs and temporary artifacts stay outside Git. This PR prepares an unreleased Console candidate; it does not publish Console, create a release tag or push a release image.