docs(s3-object-lock): pin the conformance-run corrections

Three details the implementation run against the versitygw suite pinned
differently than first specified: key existence outranks the lock-enabled
gate in the §6 check order (GetObjectRetention_non_existing_object runs
against a lock-free bucket and expects NoSuchKey, matching posix); the
missing-configuration error splits by path, with the spaced variant on the
four per-version methods and the NoSpaces variant on all three
creation-time header paths; and the controller passes an absent
retain-until header as a pointer to the zero time. §11 also records the
versioning-disabled-mode exclusion precisely and the versioned-teardown
home for lock-enabled-bucket cases from plain-conf groups.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: frrist

docs/s3-object-lock.md

@@ -72,7 +72,7 @@ bucket.
 | target version is a delete marker | `ErrMethodNotAllowed` (405) |
 | key or version absent | `ErrNoSuchKey` / `GetNoSuchVersionErr` |
 | malformed versionId | `InvalidArgument` (`InvalidArgVersionId`) |
-| lock op against a bucket without lock enabled | `ErrMissingObjectLockConfiguration` (400); the CreateMultipartUpload path uses the `...NoSpaces` variant |
+| lock op against a bucket without lock enabled | the four per-version methods answer `ErrMissingObjectLockConfiguration` (400); the creation-time header paths (PutObject, CopyObject, CreateMultipartUpload) answer the `...NoSpaces` variant — the wire messages differ by one space and the conformance suite distinguishes them |
 | `PutObjectLockConfiguration` on a non-Enabled-versioning bucket | `ErrObjectLockConfigurationNotAllowed` (409) |
 | `PutBucketVersioning(Suspended)` on a lock bucket | `ErrSuspendedVersioningNotAllowed` (400) |
 
@@ -274,14 +274,17 @@ only exist on buckets that were Enabled when it was written and can never leave
 All four run the same check order:
 
 1. `registry.Get` misses: `ErrNoSuchBucket`.
-2. `State.ObjectLockConfig` nil or not Enabled: `ErrMissingObjectLockConfiguration`
-   (`...NoSpaces` is not used here; it belongs to CreateMultipartUpload, §7). This is the
-   only lock-specific step; the rest of the order is the skeleton any per-version state
-   operation runs.
-3. `classifyVersionID` rejects the token: `InvalidArgument` (`InvalidArgVersionId`).
-4. The current version (empty versionId) or the named one resolves per the §6.1 grammar of
-   the versioning design; a miss is `ErrNoSuchKey` / `GetNoSuchVersionErr`.
-5. The resolved version is a delete marker: `ErrMethodNotAllowed` (pinned by
+2. The key is absent from the top MST: `ErrNoSuchKey`. Key existence outranks the lock
+   gate — a missing key on a bucket without lock reports `NoSuchKey`, never the
+   missing-configuration error (`GetObjectRetention_non_existing_object` pins it against a
+   lock-free bucket, matching posix).
+3. `State.ObjectLockConfig` nil or not Enabled: `ErrMissingObjectLockConfiguration`. This
+   and step 2's precedence are the only lock-specific parts of the order; the rest is the
+   skeleton any per-version state operation runs.
+4. `classifyVersionID` rejects the token: `InvalidArgument` (`InvalidArgVersionId`).
+5. The named version resolves per the §6.1 grammar of the versioning design (the current
+   version for an empty versionId); a miss is `GetNoSuchVersionErr`.
+6. The resolved version is a delete marker: `ErrMethodNotAllowed` (pinned by
    `Versioning_Put_GetObjectRetention_delete_marker` and the legal-hold twin).
 
 **Reads** run it lock-free over `resolveVersion` (`s3frontend/version.go:144`), which already
@@ -318,9 +321,11 @@ validated by the controller (`utils.ParsObjectLockHdrs`: mode and date required
 RFC3339, future-dated, known enum values). The backend's obligations:
 
 - **Validation.** Lock headers against a bucket whose `ObjectLockConfig` is not enabled:
-  `ErrMissingObjectLockConfiguration` from PutObject and CopyObject,
-  `ErrMissingObjectLockConfigurationNoSpaces` from CreateMultipartUpload (the wire messages
-  differ by one space; the conformance suite distinguishes them).
+  `ErrMissingObjectLockConfigurationNoSpaces` from all three creation-time paths (§2's
+  variant split; `PutObject_missing_bucket_lock` and `CopyObject_missing_bucket_lock` pin
+  the wording). The controller populates the retain-until pointer unconditionally, so an
+  absent header arrives as a pointer to the zero time and absence is judged on the zero
+  value, never on nil.
 - **Stamping, inside the commit.** When lock headers are present, `commitVersion` writes the
   new version's `VersionState` (retention =
   `json.Marshal(types.ObjectLockRetention{Mode, RetainUntilDate})` when a mode was supplied;
@@ -407,10 +412,18 @@ for `COMPLIANCE`), sleeps past expiry, and deletes.
 `TestWORMProtection`:
 
 - The six Put/Get groups are pass-table rows, with two exceptions.
-  `PutObjectLockConfiguration_not_enabled_on_bucket_creation` is dispatch-gated to the
-  unversioned conf upstream and is omitted with the conf choice.
+  `PutObjectLockConfiguration_not_enabled_on_bucket_creation` asserts the
+  versioning-disabled gateway mode, where a lock configuration lands on an unversioned
+  bucket with no versioning check (upstream's own comment calls it not S3 compatible);
+  ingot answers the AWS 409 and the row is excluded, with
+  `Versioning_object_lock_not_enabled_on_bucket_creation` pinning that behavior.
   `PutObjectRetention_overwrite_governance_with_permission` installs a bucket policy: XFail
   until bucket policies land.
+- Lock-enabled-bucket cases from the plain-conf groups (`PutObject_with_object_lock`,
+  `PutObject_racey_success`, the CopyObject lock-header cases,
+  `CreateMultipartUpload_with_object_lock`) run under a dedicated versioned-conf category:
+  their buckets are versioning-Enabled, and the plain teardown cannot empty a non-empty
+  versioned bucket.
 - `TestWORMProtection` contributes no pass rows yet. Its `checkWORMProtection`-based cases
   assert versitygw's unversioned-gateway lock model, where a plain PUT or unscoped DELETE
   against a locked object fails with `ErrObjectLocked`; a lock bucket in ingot is always