chen21019 · Oct 23, 2026 · Oct 23, 2026
@@ -2,9 +2,9 @@
 
 <a id="server-v16546-security-refresh"></a>
 
-## Server v1.6.546 prepared, not published
+## Server v1.6.546 published
 
-This source candidate consumes independently verified security releases.
+This release consumes independently verified security releases.
 It keeps the existing authentication, authorization, registration, storage,
 service-upgrade and API contracts. Ubuntu packages stay on the installed
 26.04 series; host Docker daemons and firewall backends are not changed.
@@ -24,6 +24,18 @@ HIGH/CRITICAL, available fixes, unregistered findings and secrets remain
 release blockers. Existing operator environment variables and named volumes
 must be preserved. See [release details](docs/releases/server-1.6.546.md).
 
+Official producer `c1b4b335f77f8faaae8239af9e8d5a8189ce07b8` passed
+[publisher 40000369416](https://github.com/PastureStack/server/actions/runs/40000369416).
+All 26 immutable release assets, the anonymous registry readback, and the
+provenance/SBOM attestations were verified. The one-layer linux/amd64 image
+manifest is `sha256:7b29b87ab40f427c2a6a5909330dd859745e9f0780166658ffd0556b6f0873d2`;
+its distinct OCI config is
+`sha256:22fbb5fe50be0317a25571b8d0ac4d1782a0bfae9959d0b72666ed8ca897f2ca`.
+The complete gate reports 51 raw findings and 29 tracked, officially unfixed
+LOW/MEDIUM occurrences across 18 CVEs, due for review on 2026-10-27.
+HIGH/CRITICAL, fixed-available, untracked findings and secrets are zero;
+this is not a zero-vulnerability claim.
+
 The internal compose executor is updated to 0.14.39. That release does not
 publish three-platform legacy Compose CLI downloads. The optional
 `RC16_ARTIFACT_BASE_URL` compatibility URLs are therefore not changed to

@@ -11,19 +11,16 @@ upstream history, authorship, licenses, and notices.
 
 <a id="current-release"></a>
 
-## Current source candidate
+## Current release
 
-Server `v1.6.546` is a prepared source candidate, not a published image.
+Server [`v1.6.546`](https://github.com/PastureStack/server/releases/tag/v1.6.546) is published.
 It updates maintained security dependencies while preserving authentication,
 API Key authorization, host registration and service-upgrade behavior.
 Engine `v0.183.354`, Web Console `1.6.194`, Host API `0.38.8`,
 WebSocket Proxy `0.23.18`, and Temurin `25.0.5+8` are verified component inputs.
 See the [546 release note](docs/releases/server-1.6.546.md) and
 [compatibility contract](COMPATIBILITY.md#server-v16546-security-refresh)
 for dependency identities and acceptance boundaries.
-This candidate is not yet available; the last published Server is
-[v1.6.545](https://github.com/PastureStack/server/releases/tag/v1.6.545)
-([published release evidence](docs/releases/server-1.6.545.md)).
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -50,9 +47,7 @@ Maintained CLI `0.6.20` propagates rejected requests as nonzero errors. Legacy `
 ## Quick start
 
 Public GHCR downloads do not require a registry login. Keep all three named volumes.
-The examples below use the candidate numeric `v1.6.546` tag;
-run them only after its official release.
-This candidate is not yet available from GHCR.
+The examples below use the published numeric `v1.6.546` tag.
 
 ```sh
 docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \

@@ -7,6 +7,13 @@ runtime gates have passed.
 
 ## Release notes
 
+- [Server v1.6.546](releases/server-1.6.546.md) — published security refresh;
+  verified component inputs, one-layer immutable image, full artifact scanning
+  and signed provenance. See the release note for scoped runtime evidence and
+  the exact officially unfixed findings; tracking is not remediation.
+- [Server v1.6.545](releases/server-1.6.545.md) — published service-upgrade and
+  endpoint identity repair with retained-data, refresh and restart verification.
+
 - [Server v1.6.537](releases/server-1.6.537.md) — published Web Console `1.6.190`
   and Engine `v0.183.350` archive/restore; official source/build, fresh startup/restart,
   final-image security/SBOM and anonymous 24-asset/image readback passed.

@@ -8,9 +8,8 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the numeric Server source candidate v1.6.546, which
-is not yet available from GHCR; run it only after its official release and image have been published and read back.
-See the [candidate release note](../releases/server-1.6.546.md) and the
+The example uses the published numeric Server v1.6.546 tag.
+See the [release note](../releases/server-1.6.546.md) and the
 [current release](../../README.md#current-release) for component versions and
 release details. Preserve the existing runtime overrides and all three named
 volumes during an upgrade or restart.

@@ -1,9 +1,18 @@
-# Server v1.6.546 candidate
+# Server v1.6.546
 
-Security-refresh source candidate. The Server image has not yet been published
-or accepted on the 8080 test installation. This document must not be used as
-runtime acceptance evidence until those results are added.
-Prepared source only; no Server image or release has been published.
+Published security refresh from producer
+`c1b4b335f77f8faaae8239af9e8d5a8189ce07b8` via
+[publisher 40000369416](https://github.com/PastureStack/server/actions/runs/40000369416).
+The immutable release contains 26 assets with verified SHA-256 checksums;
+anonymous registry and asset readback, provenance and SBOM attestations passed.
+
+- Manifest: `sha256:7b29b87ab40f427c2a6a5909330dd859745e9f0780166658ffd0556b6f0873d2`.
+- OCI config: `sha256:22fbb5fe50be0317a25571b8d0ac4d1782a0bfae9959d0b72666ed8ca897f2ca`.
+- Platform: linux/amd64; one runtime layer. The maintained multi-stage build
+  and component verification are retained.
+
+Install with `ghcr.io/pasturestack/server:v1.6.546`; the digests above identify
+the artifact, not a replacement for the numeric-tag installation examples.
 
 ## Verified component inputs
 
@@ -45,11 +54,13 @@ Prepared source only; no Server image or release has been published.
 ## Compatibility and evidence
 
 Existing OIDC, MFA, API Key, service-upgrade and permission contracts are not
-changed. The publisher must pass the normal source, CodeQL, artifact,
-security, startup and restart checks before publication. QA then verifies the
-exact image on the isolated QA deployment, including login, authenticated APIs, WebSocket,
-host/agent connectivity and retained workload data. Unrelated previously
-accepted features are not represented as newly retested.
+changed. The publisher passed normal source, CodeQL, artifact,
+security, startup and restart checks. Deployment to the isolated QA installation
+preserved the existing environment overrides, HostConfig, persistent mounts,
+AppArmor and previous rollback container. The running zlib backport's bytes,
+MariaDB linkage and a read-only compression roundtrip were verified. Existing
+primary/sidekick identities and volume content remained intact.
+Unrelated previously accepted features are not represented as newly retested.
 
 Raw scans and SBOMs remain separate from vulnerability dispositions. An
 officially unfixed LOW/MEDIUM finding is tracked against its exact artifact,
@@ -60,6 +71,13 @@ dispositions. Before applying them, the publisher verifies each affected
 executable path, module version and exact binary SHA256; a new or changed
 consumer cannot inherit the exception just by using the same module version.
 
+The complete artifact gate retained 51 raw occurrences. After exact existing
+VEX dispositions, 29 officially unfixed LOW/MEDIUM occurrences across 18 CVEs
+remain tracked for review by 2026-10-27. There are no HIGH/CRITICAL,
+fixed-available or unregistered findings, or detected secrets. No severity or
+release check was bypassed; seven rejected publisher attempts produced no
+release and remain historical evidence.
+
 ## Upgrade and rollback
 
 Preserve the three existing named volumes, all operator environment

@@ -21,13 +21,12 @@ image versions are separate; a template-only upgrade may keep the same image.
 
 ## Persisted runtime coordinates
 
-The current composition source prepares Load Balancer Service `v0.9.32` as
-the image default and in both HA Compose templates. This is a source candidate,
-not a claim that a new Server image has been published. Database settings and
+Server `v1.6.546` provides Load Balancer Service `v0.9.33` as
+the image default and in both HA Compose templates. Database settings and
 explicit operator overrides take precedence over the new image defaults.
 An existing persisted `v0.9.27` pair therefore stays on `v0.9.27`; an administrator
 must explicitly update both `lb.instance.image` and `lb.instance.image.uuid`
-to select `v0.9.32` for newly created load balancers. Preserve custom images and
+to select `v0.9.33` for newly created load balancers. Preserve custom images and
 mixed settings for operator review.
 
 Changing these defaults or settings does not replace existing Services or their
@@ -38,7 +37,7 @@ images and finish their upgrades automatically.
 
 The coordinate migration tool below retains its earlier reviewed targets. Its
 `apply` action overwrites allowlisted settings, including custom LB coordinates;
-it is not an automatic `v0.9.27` to `v0.9.32` upgrade path. Use its read-only audit
+it is not an automatic `v0.9.27` to `v0.9.33` upgrade path. Use its read-only audit
 to inspect persisted configuration before choosing a migration.
 
 A new container image does not automatically replace values already stored in