[Vonng]

Release SILO Console 2.7.0 with the fixes found in its final pre-release review. The earlier v2.7.0 tag (26ce922) only ever produced an unpublished Draft Release and candidate image; after this PR lands, the draft and tag are replaced and v2.7.0 is recut on this branch's last commit. The candidate image was never pulled outside release verification, and latest never pointed to it.

Fixes

• Plain HTTP: "Calculate folder sizes" and the decryption-key copy now work when Console is opened over plain HTTP. The common embedded URL http://<ip>:9001 is not a secure context, so crypto.randomUUID and navigator.clipboard do not exist there.
• Usage worker TLS: console usage-worker accepts --certs-dir. It trusts certs/CAs and Console's public.crt, and applies CONSOLE_MINIO_SERVER_TLS_SKIP_VERIFY to the SILO origin only. The worker neither creates the directory nor loads private.key. console server certificate loading is unchanged.
• Scan budget: SCAN_TIMEOUT now counts listing time summed across slices, not time spent queued behind other buckets. The exhausted budget is recorded on every duration exit.
• Worker shutdown: a scan interrupted by shutdown, including one stopped during a database write, goes back to the queue with its checkpoint. It is no longer shown as error with a 30 s backoff.
• Bucket deletion: the worker handles s3:BucketRemoved and s3:BucketCreated. A deleted bucket's totals are forgotten, so a bucket re-created under the same name never shows them. If the deletion cannot be persisted at once, it is kept and retried.
• Busy scanner: without the usage database, Refresh retries an HTTP 429 with backoff before marking a bucket as failed.
• Multipart uploads: malformed or truncated multipart uploads return an error instead of a nil-part panic. Only an unwrapped io.EOF ends the loop, because the standard library reports a truncated body as a wrapped EOF.
• Hardening:
  • A canceled bucket-usage authorization probe is never treated as authorized.
  • The share-link expiry no longer depends on Luxon's locale. This is not a user-facing bug today: Luxon formats as en-US unless a locale is set.
• Release metadata: the fixes are recorded in the v2.7.0 CHANGELOG section, and the source docs no longer use draft or candidate wording. The version and embedded assets stay at 2.7.0.

Verification (local)

• Go: build, vet and go test ./... pass. golangci-lint reports 0 issues. The CREDITS, replacement and deps-release structural checks pass.
• PostgreSQL: the usage integration suite (-tags=integration) passes against PostgreSQL 18.
• Frontend:
  • Unit tests: 792/792 passed in the first full run. A later run had one failure in ff-controls.unit.ts, a file this PR does not touch, which passed three times in isolation.
  • tsc, prettier, knip and the bundle budgets pass.
  • The embedded assets rebuild byte for byte.
• Regression tests: each new test fails on the previous code. Exceptions: the budget-race test fails with high probability rather than deterministically, and the shutdown-during-write test injects the canceled error directly.
• Review: an adversarial Codex review asked for changes in round 1 (7 items). After the fixes, round 2 returned APPROVE WITH NITS. The two remaining nits are P3 test-coverage suggestions.

Upgrade note

During a rolling upgrade, stop older usage workers before starting 2.7.0 workers. A mixed fleet does not accumulate the new listing-time budget consistently.

🤖 Generated with Claude Code