[helloimalastair]

Summary

R2 returns 409 Conflict for ObjectLockedByBucketPolicy (10069), but the error codes page listed it as 403. When a write is blocked by a bucket lock rule and would also fail a conditional header such as If-None-Match: *, the lock check is evaluated first, so the response is 409 ObjectLockedByBucketPolicy rather than 412 PreconditionFailed. This change brings docs into alignment with existing behaviour.

Documentation checklist

• The change adheres to the documentation style guide.

[cloudflare-docs-bot]

AI Review

✅ Reviewed 10b4d66 · 0 findings · incremental

Commands

• /review Run a review now.
• /full-review Review the entire PR diff.
• /disable-auto-review Stop automatic reviews.
• /rebase Rebase against production.

[cloudflare-docs-bot]

Review coverage

🟡 1 ownership area needs approval.

Suggested reviewers: @vy-ton @WalshyDev

Needs approval	Eligible approvers	Suggested
r2	@carolx715, @enorman-cf, @helloimalastair, @rdimaio, @soumyakhanna05, @vy-ton, @cloudflare/product-owners	vy-ton, WalshyDev

CODEOWNERS mappings for displayed areas (1)

Pattern	Owners
/src/content/docs/r2/	@carolx715, @enorman-cf, @helloimalastair, @rdimaio, @soumyakhanna05, @vy-ton, @cloudflare/product-owners

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://document-409-objectlockedbybucketpolicy.previews.developers.cloudflare.com (commit 10b4d66)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://692bccc0.previews.developers.cloudflare.com	10b4d66	2026-10-26T18:13:31.992Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://a2b77c82.previews.developers.cloudflare.com	9ab873f	2026-10-23T23:11:53.976Z	Visit the dashboard ↗

[github-actions]

Worker Preview URL: https://gh-document-409-objectlockedbybucketpolicy.previews.developers.cloudflare.com
Worker Preview Deployment URL: https://b07b3896.previews.developers.cloudflare.com

Files with changes (up to 15)

Original Link	Updated Link
https://developers.cloudflare.com/r2/api/error-codes/	https://gh-document-409-objectlockedbybucketpolicy.previews.developers.cloudflare.com/r2/api/error-codes/
https://developers.cloudflare.com/r2/buckets/bucket-locks/	https://gh-document-409-objectlockedbybucketpolicy.previews.developers.cloudflare.com/r2/buckets/bucket-locks/

[rdimaio]

[IMPORTANT] Copying an object onto itself returns 409 on a locked object, not the 412 this row promises

Problem: The new CopyObject sentence says source conditions always win over the destination lock check. That holds only for copies to a different key, storage-class changes, and SSE-C copies. For a same-key copy (the usual in-place metadata update), the lock check runs first.

Evidence: In src/content/docs/r2/api/error-codes.mdx:66, `CopyObject` source conditions (`x-amz-copy-source-if-*`) are evaluated before the destination lock check, so those return `412` even when the destination is locked. In r2-gateway-worker/src/durable_objects/bucket/server.ts:13838-13861, the lock check returns ObjectLockedByBucketLockRule before sourceCopyConditions is evaluated. In r2-metadata-worker/src/store/bucket.ts:919, WHEN object_locked THEN 'OBJECT_LOCKED_BY_BUCKET_LOCK_RULE' precedes every IF_*_FAILED branch. A same-key CopyObject with x-amz-metadata-directive: REPLACE and a failing x-amz-copy-source-if-match therefore returns 409.

Suggested fix: Narrow the sentence to the cases where it is true and name the exception, or drop it. For example: "For a copy to a different key (or one that changes storage class or uses SSE-C), CopyObject source conditions are evaluated before the destination lock check and return 412. For a copy of an object onto itself, the lock check runs first and returns 409."

_{SCR v2.0.1 run by rdimaio on 10b4d66}