Document Server 1.6.552 publication and verified upgrade

COMPATIBILITY.md

@@ -2,12 +2,20 @@
 
 <a id="server-v16552-runtime-backports"></a>
 
-## Server v1.6.552 prepared, not published
-
-This source candidate prepares the numeric `ghcr.io/pasturestack/server:v1.6.552`
-image tag. It has not been published. The normal publisher must retain the exact
-producer, OCI digest, SBOM, original vulnerability report and interpreted report
-before the candidate can be used.
+## Server v1.6.552 published
+
+The published linux/amd64 image is
+`ghcr.io/pasturestack/server:v1.6.552@sha256:f19a0fdd7340fde910c8eb66311bbe11d682301f5fe2df7768638b866e5ef1f4`,
+produced from `6be16e0c62473e65e4222e144fba513d61717f34` in successful
+[run 40149543657](https://github.com/PastureStack/server/actions/runs/40149543657).
+Its source, startup, restart, raw/qualified vulnerability scans and SBOM gates
+passed before publication. Anonymous asset and registry identity readback and
+both native image attestations were verified against this exact producer.
+
+The 8080 test deployment retained its settings, three data volumes, socket
+bind, AppArmor and restart policy. Package checks, MariaDB regex controls,
+one restart and all three Host/Agent states passed. The 551 rollback remains
+available. Production, HAProxy and host firewall configuration were not changed.
 
 The digest-pinned, build-only Ubuntu backport bundle installs only existing
 packages. It retains the original package set, selected coreutils provider and

README.md

@@ -11,9 +11,9 @@ upstream history, authorship, licenses, and notices.
 
 <a id="current-release"></a>
 
-## Current source candidate
+## Current release
 
-Server `v1.6.552` is a prepared source candidate, not a published image.
+Server `v1.6.552` is the current published release.
 It includes Ubuntu security backports from verified upstream releases and accepted
 fixes. Each image updates only packages already installed, preserving its package
 set, coreutils provider, configuration and library interfaces. The compiler stages
@@ -24,9 +24,8 @@ Host API `0.38.8` and Temurin `25.0.5+8` retain their verified inputs.
 Node Agent `v1.2.33` uses compatibility base `v0.3.7`; Catalog `v0.3.17`
 references the corresponding verified component images.
 
-The published release is [Server v1.6.551](https://github.com/PastureStack/server/releases/tag/v1.6.551),
-with its [publication note](docs/releases/server-1.6.551.md).
-See the [candidate note](docs/releases/server-1.6.552.md) and
+See [Server v1.6.552](https://github.com/PastureStack/server/releases/tag/v1.6.552),
+its [release note](docs/releases/server-1.6.552.md) and the
 [compatibility contract](COMPATIBILITY.md#server-v16552-runtime-backports)
 for producer identities, immutable image digests, SBOMs and remaining findings.
 
@@ -55,8 +54,7 @@ Maintained CLI `0.6.20` propagates rejected requests as nonzero errors. Legacy `
 ## Quick start
 
 Public GHCR downloads do not require a registry login. Keep all three named volumes.
-The examples below use the numeric `v1.6.552` tag; run them only after its official release.
-This candidate is not yet available from GHCR.
+The examples below use the published numeric `v1.6.552` tag.
 
 ```sh
 docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \

docs/performance/README.md

@@ -8,9 +8,8 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example prepares the numeric Server v1.6.552 tag; run it only after its official release and image have been published and read back.
-This candidate is not yet available from GHCR.
-See the [candidate note](../releases/server-1.6.552.md) and the
+The example uses the published numeric Server v1.6.552 tag.
+See the [release note](../releases/server-1.6.552.md) and the
 [current release](../../README.md#current-release) for component versions and
 release details. Preserve the existing runtime overrides and all three named
 volumes during an upgrade or restart.

docs/releases/server-1.6.552.md

@@ -1,6 +1,10 @@
-# Server v1.6.552 candidate
+# Server v1.6.552
 
-Prepared source only; no Server image or release has been published.
+Published image: `ghcr.io/pasturestack/server:v1.6.552@sha256:f19a0fdd7340fde910c8eb66311bbe11d682301f5fe2df7768638b866e5ef1f4`.
+
+Source commit: `6be16e0c62473e65e4222e144fba513d61717f34`.
+
+The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.
 
 ## Verified component inputs
 
@@ -36,3 +40,14 @@ The official release includes the producer commit, immutable image digest,
 checksums, SBOMs, vulnerability reports and qualification receipts. Consult
 [the compatibility contract](../../COMPATIBILITY.md#server-v16552-runtime-backports)
 for the retained runtime boundaries.
+
+## Scoped QA acceptance
+
+The QA Server was updated by exact digest, then restarted once.
+The existing environment overrides, three named data volumes, Docker socket
+bind, AppArmor and restart policy were preserved. The prior v1.6.551 container
+and image remain available for rollback with the consistent database backup.
+PCRE2 integrity, runtime library versions, MariaDB regular-expression controls,
+/ping and all three active Host/Agent states passed. This is scoped acceptance;
+unrelated UI, role and language tests were not rerun. No production site,
+HAProxy or firewall was changed.