diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
index 9239fd6152..36567efdf5 100644
--- a/COMPATIBILITY.md
+++ b/COMPATIBILITY.md
@@ -2,9 +2,9 @@
-## Server v1.6.546 prepared, not published
+## Server v1.6.546 published
-This source candidate consumes independently verified security releases.
+This release consumes independently verified security releases.
It keeps the existing authentication, authorization, registration, storage,
service-upgrade and API contracts. Ubuntu packages stay on the installed
26.04 series; host Docker daemons and firewall backends are not changed.
@@ -24,6 +24,18 @@ HIGH/CRITICAL, available fixes, unregistered findings and secrets remain
release blockers. Existing operator environment variables and named volumes
must be preserved. See [release details](docs/releases/server-1.6.546.md).
+Official producer `c1b4b335f77f8faaae8239af9e8d5a8189ce07b8` passed
+[publisher 40000369416](https://github.com/PastureStack/server/actions/runs/40000369416).
+All 26 immutable release assets, the anonymous registry readback, and the
+provenance/SBOM attestations were verified. The one-layer linux/amd64 image
+manifest is `sha256:7b29b87ab40f427c2a6a5909330dd859745e9f0780166658ffd0556b6f0873d2`;
+its distinct OCI config is
+`sha256:22fbb5fe50be0317a25571b8d0ac4d1782a0bfae9959d0b72666ed8ca897f2ca`.
+The complete gate reports 51 raw findings and 29 tracked, officially unfixed
+LOW/MEDIUM occurrences across 18 CVEs, due for review on 2026-10-27.
+HIGH/CRITICAL, fixed-available, untracked findings and secrets are zero;
+this is not a zero-vulnerability claim.
+
The internal compose executor is updated to 0.14.39. That release does not
publish three-platform legacy Compose CLI downloads. The optional
`RC16_ARTIFACT_BASE_URL` compatibility URLs are therefore not changed to
diff --git a/README.md b/README.md
index 25e6313cf7..3a1fcc7c00 100644
--- a/README.md
+++ b/README.md
@@ -11,9 +11,9 @@ upstream history, authorship, licenses, and notices.
-## Current source candidate
+## Current release
-Server `v1.6.546` is a prepared source candidate, not a published image.
+Server [`v1.6.546`](https://github.com/PastureStack/server/releases/tag/v1.6.546) is published.
It updates maintained security dependencies while preserving authentication,
API Key authorization, host registration and service-upgrade behavior.
Engine `v0.183.354`, Web Console `1.6.194`, Host API `0.38.8`,
@@ -21,9 +21,6 @@ WebSocket Proxy `0.23.18`, and Temurin `25.0.5+8` are verified component inputs.
See the [546 release note](docs/releases/server-1.6.546.md) and
[compatibility contract](COMPATIBILITY.md#server-v16546-security-refresh)
for dependency identities and acceptance boundaries.
-This candidate is not yet available; the last published Server is
-[v1.6.545](https://github.com/PastureStack/server/releases/tag/v1.6.545)
-([published release evidence](docs/releases/server-1.6.545.md)).
Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
@@ -50,9 +47,7 @@ Maintained CLI `0.6.20` propagates rejected requests as nonzero errors. Legacy `
## Quick start
Public GHCR downloads do not require a registry login. Keep all three named volumes.
-The examples below use the candidate numeric `v1.6.546` tag;
-run them only after its official release.
-This candidate is not yet available from GHCR.
+The examples below use the published numeric `v1.6.546` tag.
```sh
docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
diff --git a/docs/README.md b/docs/README.md
index 74dec84e48..d61ca16e69 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -7,6 +7,13 @@ runtime gates have passed.
## Release notes
+- [Server v1.6.546](releases/server-1.6.546.md) — published security refresh;
+ verified component inputs, one-layer immutable image, full artifact scanning
+ and signed provenance. See the release note for scoped runtime evidence and
+ the exact officially unfixed findings; tracking is not remediation.
+- [Server v1.6.545](releases/server-1.6.545.md) — published service-upgrade and
+ endpoint identity repair with retained-data, refresh and restart verification.
+
- [Server v1.6.537](releases/server-1.6.537.md) — published Web Console `1.6.190`
and Engine `v0.183.350` archive/restore; official source/build, fresh startup/restart,
final-image security/SBOM and anonymous 24-asset/image readback passed.
diff --git a/docs/performance/README.md b/docs/performance/README.md
index 1dc27c9eb5..4ca0639944 100644
--- a/docs/performance/README.md
+++ b/docs/performance/README.md
@@ -8,9 +8,8 @@ The following example is appropriate as a starting point for a dedicated
16-vCPU host with about 32 GiB of RAM. It is not a universal performance
profile; measure the real workload before increasing it further.
-The example uses the numeric Server source candidate v1.6.546, which
-is not yet available from GHCR; run it only after its official release and image have been published and read back.
-See the [candidate release note](../releases/server-1.6.546.md) and the
+The example uses the published numeric Server v1.6.546 tag.
+See the [release note](../releases/server-1.6.546.md) and the
[current release](../../README.md#current-release) for component versions and
release details. Preserve the existing runtime overrides and all three named
volumes during an upgrade or restart.
diff --git a/docs/releases/server-1.6.546.md b/docs/releases/server-1.6.546.md
index 767ad6cfdb..9fe26b602d 100644
--- a/docs/releases/server-1.6.546.md
+++ b/docs/releases/server-1.6.546.md
@@ -1,9 +1,18 @@
-# Server v1.6.546 candidate
+# Server v1.6.546
-Security-refresh source candidate. The Server image has not yet been published
-or accepted on the 8080 test installation. This document must not be used as
-runtime acceptance evidence until those results are added.
-Prepared source only; no Server image or release has been published.
+Published security refresh from producer
+`c1b4b335f77f8faaae8239af9e8d5a8189ce07b8` via
+[publisher 40000369416](https://github.com/PastureStack/server/actions/runs/40000369416).
+The immutable release contains 26 assets with verified SHA-256 checksums;
+anonymous registry and asset readback, provenance and SBOM attestations passed.
+
+- Manifest: `sha256:7b29b87ab40f427c2a6a5909330dd859745e9f0780166658ffd0556b6f0873d2`.
+- OCI config: `sha256:22fbb5fe50be0317a25571b8d0ac4d1782a0bfae9959d0b72666ed8ca897f2ca`.
+- Platform: linux/amd64; one runtime layer. The maintained multi-stage build
+ and component verification are retained.
+
+Install with `ghcr.io/pasturestack/server:v1.6.546`; the digests above identify
+the artifact, not a replacement for the numeric-tag installation examples.
## Verified component inputs
@@ -45,11 +54,13 @@ Prepared source only; no Server image or release has been published.
## Compatibility and evidence
Existing OIDC, MFA, API Key, service-upgrade and permission contracts are not
-changed. The publisher must pass the normal source, CodeQL, artifact,
-security, startup and restart checks before publication. QA then verifies the
-exact image on the isolated QA deployment, including login, authenticated APIs, WebSocket,
-host/agent connectivity and retained workload data. Unrelated previously
-accepted features are not represented as newly retested.
+changed. The publisher passed normal source, CodeQL, artifact,
+security, startup and restart checks. Deployment to the isolated QA installation
+preserved the existing environment overrides, HostConfig, persistent mounts,
+AppArmor and previous rollback container. The running zlib backport's bytes,
+MariaDB linkage and a read-only compression roundtrip were verified. Existing
+primary/sidekick identities and volume content remained intact.
+Unrelated previously accepted features are not represented as newly retested.
Raw scans and SBOMs remain separate from vulnerability dispositions. An
officially unfixed LOW/MEDIUM finding is tracked against its exact artifact,
@@ -60,6 +71,13 @@ dispositions. Before applying them, the publisher verifies each affected
executable path, module version and exact binary SHA256; a new or changed
consumer cannot inherit the exception just by using the same module version.
+The complete artifact gate retained 51 raw occurrences. After exact existing
+VEX dispositions, 29 officially unfixed LOW/MEDIUM occurrences across 18 CVEs
+remain tracked for review by 2026-10-27. There are no HIGH/CRITICAL,
+fixed-available or unregistered findings, or detected secrets. No severity or
+release check was bypassed; seven rejected publisher attempts produced no
+release and remain historical evidence.
+
## Upgrade and rollback
Preserve the three existing named volumes, all operator environment
diff --git a/docs/upgrades/README.md b/docs/upgrades/README.md
index 7e60be047f..9e7d4d110c 100644
--- a/docs/upgrades/README.md
+++ b/docs/upgrades/README.md
@@ -21,13 +21,12 @@ image versions are separate; a template-only upgrade may keep the same image.
## Persisted runtime coordinates
-The current composition source prepares Load Balancer Service `v0.9.32` as
-the image default and in both HA Compose templates. This is a source candidate,
-not a claim that a new Server image has been published. Database settings and
+Server `v1.6.546` provides Load Balancer Service `v0.9.33` as
+the image default and in both HA Compose templates. Database settings and
explicit operator overrides take precedence over the new image defaults.
An existing persisted `v0.9.27` pair therefore stays on `v0.9.27`; an administrator
must explicitly update both `lb.instance.image` and `lb.instance.image.uuid`
-to select `v0.9.32` for newly created load balancers. Preserve custom images and
+to select `v0.9.33` for newly created load balancers. Preserve custom images and
mixed settings for operator review.
Changing these defaults or settings does not replace existing Services or their
@@ -38,7 +37,7 @@ images and finish their upgrades automatically.
The coordinate migration tool below retains its earlier reviewed targets. Its
`apply` action overwrites allowlisted settings, including custom LB coordinates;
-it is not an automatic `v0.9.27` to `v0.9.32` upgrade path. Use its read-only audit
+it is not an automatic `v0.9.27` to `v0.9.33` upgrade path. Use its read-only audit
to inspect persisted configuration before choosing a migration.
A new container image does not automatically replace values already stored in