docs: record CORS trust and explicit version delete authorization

content/administration/bucket-replication/bucket-replication-requirements.md

@@ -133,6 +133,13 @@ The following policy provides permissions for enabling synchronization of replic
 - The `"EnableReplicationOnBucket"` statement grants permission for a remote target to retrieve bucket-level configuration for supporting replication operations on *all* buckets in the MinIO deployment. To restrict the policy to specific buckets, specify those buckets as an element in the `Resource` array similar to `"arn:aws:s3:::bucketName"`.
 - The `"EnableReplicatingDataIntoBucket"` statement grants permission for a remote target to synchronize data into *any* bucket in the MinIO deployment. To restrict the policy to specific buckets, specify those buckets as an element in the `Resource` array similar to `"arn:aws:s3:::bucketName/*"`.
 
+Replicated deletes on a SILO target use the established receiver contract
+`s3:DeleteObject` plus `s3:ReplicateDelete`. The replication credential does
+not also need an allow for `s3:DeleteObjectVersion`; however, an explicit deny
+on `s3:DeleteObjectVersion` still blocks the corresponding version purge. This
+internal contract does not change the permission for an ordinary S3 client,
+which needs `s3:DeleteObjectVersion` whenever it explicitly names a version.
+
 The following code creates a [MinIO-managed user](/administration/identity-access-management/minio-user-management/#minio-users) with the necessary policy. Replace `TARGET` with the [alias](/reference/minio-mc/mc-alias-set/#alias) of the MinIO deployment on which you are configuring replication:
 
 ```shell

content/administration/bucket-replication/bucket-replication-requirements.zh.md

@@ -133,6 +133,11 @@ mc admin policy attach TARGET ReplicationAdminPolicy --user=ReplicationAdmin
 - `"EnableReplicationOnBucket"` 语句授予远端目标获取存储桶级配置的权限， 从而支持在 MinIO 部署中 *所有* 存储桶上执行复制操作。 如果要将策略限制到特定存储桶，请像 `"arn:aws:s3:::bucketName"` 一样， 在 `Resource` 数组中指定这些存储桶。
 - `"EnableReplicatingDataIntoBucket"` 语句授予远端目标将数据同步到 MinIO 部署中 *任意* 存储桶的权限。 如果要将策略限制到特定存储桶，请像 `"arn:aws:s3:::bucketName/*"` 一样， 在 `Resource` 数组中指定这些存储桶。
 
+SILO 目标端的复制删除沿用 `s3:DeleteObject` 加 `s3:ReplicateDelete` 的 receiver
+契约。复制凭据不需要额外获得 `s3:DeleteObjectVersion` 的 Allow；但显式 Deny
+`s3:DeleteObjectVersion` 仍会阻止对应的版本清理。这个内部契约不改变普通 S3
+客户端的要求：只要请求明确指定版本，就必须具备 `s3:DeleteObjectVersion`。
+
 下列代码使用所需策略创建一个 [MinIO 管理用户](/zh/administration/identity-access-management/minio-user-management/#minio-users)。 将 `TARGET` 替换为你要配置复制的 MinIO 部署的 [别名](/zh/reference/minio-mc/mc-alias-set/#alias)：
 
 ```shell

content/administration/identity-access-management/policy-based-access-control.md

@@ -256,6 +256,11 @@ Controls access to the [ListBuckets](https://docs.aws.amazon.com/AmazonS3/latest
 
 Controls access to the [DeleteObject](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html) S3 API operation.
 
+This action authorizes a delete request that does not explicitly name a
+version. On a versioned bucket, that request creates a delete marker. It does
+not authorize `DELETE ?versionId=...` or a `DeleteObjects` entry containing
+`VersionId`.
+
 Supports the following additional [condition key](#minio-policy-conditions):
 
 ```shell
@@ -520,6 +525,10 @@ Controls access to the [GetBucketVersioning](https://docs.aws.amazon.com/AmazonS
 
 Controls access to the [DeleteObjectVersion](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectVersion.html) S3 API operation.
 
+This action authorizes deletion of an explicitly named UUID or the explicit
+`null` version. In `DeleteObjects`, SILO evaluates this action independently for
+each entry that contains `VersionId`.
+
 Supports the following additional [condition keys](#minio-policy-conditions):
 
 ```shell

content/administration/identity-access-management/policy-based-access-control.zh.md

@@ -256,6 +256,10 @@ MinIO 策略文档支持 IAM [S3 Action keys](https://docs.aws.amazon.com/IAM/la
 
 控制对 [DeleteObject](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html) S3 API 操作的访问。
 
+此操作授权未显式指定版本的删除请求。在启用版本控制的存储桶上，该请求会创建
+delete marker。它不授权 `DELETE ?versionId=...`，也不授权 `DeleteObjects` 中
+携带 `VersionId` 的条目。
+
 支持以下额外[条件键](#minio-policy-conditions)：
 
 ```shell
@@ -520,6 +524,9 @@ s3:RequestObjectTag/<key>
 
 控制对 [DeleteObjectVersion](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectVersion.html) S3 API 操作的访问。
 
+此操作授权删除明确指定的 UUID 或显式 `null` 版本。在 `DeleteObjects` 中，SILO
+会对每个携带 `VersionId` 的条目独立检查该权限。
+
 支持以下附加 [condition keys](#minio-policy-conditions)：
 
 ```shell

content/administration/object-management/object-delete.md

@@ -26,6 +26,20 @@ Any combination of the following factors may impact how `DELETE` operations func
 
 MinIO uses a [policy based access control](/administration/identity-access-management/policy-based-access-control/#minio-policy) system for access management. The user or service account must provide the correct policy action and conditions to allow a `DELETE` for the bucket and object.
 
+The required action is selected from the request, not merely from whether the
+bucket has versioning enabled:
+
+| Request | Required action |
+| --- | --- |
+| `DELETE` without `versionId` | `s3:DeleteObject` |
+| `DELETE` with a version UUID | `s3:DeleteObjectVersion` |
+| `DELETE` with `versionId=null` | `s3:DeleteObjectVersion` |
+| `DeleteObjects` | Evaluated independently for each XML entry |
+
+An explicit deny always takes precedence. Conditions using `s3:versionid` see
+the effective version ID of the object being deleted; a query parameter on the
+outer `DeleteObjects` request does not replace an entry's `VersionId`.
+
 ## Unversioned Objects {#unversioned-objects}
 
 When performing a `DELETE` operation on an object in a bucket that does not have versioning enabled, the operation is straightforward. After verifying the user or service account has permission to perform the `DELETE` operation, MinIO permanently removes the object.
@@ -36,7 +50,10 @@ The user or service account requesting the delete action the action must have th
 
 `DELETE` operations work differently when an object is versioned.
 
-The user or service account must have the [`s3:DeleteObjectVersion`](/administration/identity-access-management/policy-based-access-control/#policy-action.s3-DeleteObjectVersion) action permission for the bucket and object.
+Deleting a specifically named version requires
+[`s3:DeleteObjectVersion`](/administration/identity-access-management/policy-based-access-control/#policy-action.s3-DeleteObjectVersion).
+Deleting without a version ID still requires `s3:DeleteObject` and creates a
+delete marker instead of removing an existing version.
 
 ### Delete operations on the current version {#delete-operations-on-the-current-version}
 

content/administration/object-management/object-delete.zh.md

@@ -26,6 +26,18 @@ upstream_modified: false
 
 MinIO 使用 [基于策略的访问控制](/zh/administration/identity-access-management/policy-based-access-control/#minio-policy) 系统进行访问管理。 用户或服务账户必须提供正确的策略操作和条件，才能对该存储桶和对象执行 `DELETE`。
 
+所需权限由请求是否显式指定版本决定，而不是仅由存储桶是否启用版本控制决定：
+
+| 请求 | 所需权限 |
+| --- | --- |
+| 未携带 `versionId` 的 `DELETE` | `s3:DeleteObject` |
+| 携带版本 UUID 的 `DELETE` | `s3:DeleteObjectVersion` |
+| 携带 `versionId=null` 的 `DELETE` | `s3:DeleteObjectVersion` |
+| `DeleteObjects` | 对 XML 中的每个条目独立判定 |
+
+显式 `Deny` 始终优先。`s3:versionid` 条件读取当前条目实际删除的版本 ID；外层
+`DeleteObjects` 请求上的查询参数不能覆盖条目自己的 `VersionId`。
+
 ## 未启用版本控制的对象 {#id5}
 
 如果对未启用版本控制的存储桶中的对象执行 `DELETE` 操作，其行为比较直接。 在确认用户或服务账户具有执行 `DELETE` 操作的权限后，MinIO 会永久删除该对象。
@@ -36,7 +48,10 @@ MinIO 使用 [基于策略的访问控制](/zh/administration/identity-access-ma
 
 启用版本控制后，`DELETE` 操作的行为会有所不同。
 
-用户或服务账户必须对该存储桶和对象具有 [`s3:DeleteObjectVersion`](/zh/administration/identity-access-management/policy-based-access-control/#policy-action.s3-DeleteObjectVersion) 操作权限。
+删除一个明确指定的版本需要
+[`s3:DeleteObjectVersion`](/zh/administration/identity-access-management/policy-based-access-control/#policy-action.s3-DeleteObjectVersion)
+权限。未指定版本 ID 的删除仍需要 `s3:DeleteObject`，它会创建 delete marker，
+而不会移除现有版本。
 
 ### 删除当前版本 {#id7}