Align current release documentation with verified Server 551

COMPATIBILITY.md

@@ -1,17 +1,46 @@
 # Compatibility Contract
 
+<a id="server-v16551-release-assets"></a>
+
+## Server v1.6.551 published
+
+The immutable linux/amd64 image is
+`ghcr.io/pasturestack/server:v1.6.551@sha256:150c3eaa2d84df6236e7634843e506a79df71d9e434ad2038427108c14ac358e`,
+produced from `9abef4712901981e5917c41356bb261974fdba47` in successful
+[run 40120970328](https://github.com/PastureStack/server/actions/runs/40120970328).
+All 33 assets passed anonymous byte/checksum readback. The Host API archive also
+matches its original producer SHA-256, retains its internal checksums and binary,
+and both image attestations bind the exact producer and digest.
+
+The 550 PCRE2 fixes, Web Console 1.6.195, Engine v0.183.354 and other component
+inputs are unchanged. The 8080 cutover, one restart, package integrity/linkage,
+MariaDB regex controls and three active Host/Agent states passed. Configuration,
+three existing data volumes, socket bind, AppArmor and the 550 rollback were
+preserved. No production site, HAProxy or firewall was changed.
+
+The scan retains 13 pending LOW/MEDIUM occurrences across 10 CVEs. Unrelated
+native candidates and build-host coverage are separate; none is presented as a
+remediated consumer. See the [release note](docs/releases/server-1.6.551.md).
+
 <a id="server-v16550-pcre2-backports"></a>
 
 ## Server v1.6.550 published
 
+The Server image is valid, but its standalone Host API Release attachment was
+mistakenly replaced with an empty gzip during manual publication completion.
+Use 551 or the original Host API producer release for that download. The immutable
+bad attachment is retained as failure evidence; checksum self-consistency alone
+did not establish producer identity. See the [correction](docs/releases/server-1.6.550.md).
+
 The immutable one-layer linux/amd64 identity is
 `ghcr.io/pasturestack/server:v1.6.550@sha256:03542028c3ce4be11d7ff87f96beddf5179c67caf9f0d28ad57043acf3cf52c5`,
 produced from `54deb98ee33ffab78437070d61179b602844182e` in
 [run 40116218929](https://github.com/PastureStack/server/actions/runs/40116218929).
 All 34 assets passed anonymous checksum readback; both image provenance and SBOM
 attestations bind the same digest and producer. The original job remains failed
-at its final release-note heading check. The exact signed image and original CI
-bytes completed publication without a rebuild or tag overwrite; see the immutable
+at its final release-note heading check. The exact signed image completed
+publication without a rebuild or tag overwrite; the attachment correction above
+supersedes the broader asset claim in the original immutable
 [completion receipt](https://github.com/PastureStack/server/releases/download/v1.6.550/publication-recovery.json).
 The permanent note preflight now validates the actual candidate document.
 

README.md

@@ -13,20 +13,21 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-Server [`v1.6.550`](https://github.com/PastureStack/server/releases/tag/v1.6.550) is published.
-It fixes eight PCRE2 CVEs using the upstream-supported 10.46 backports and
+Server [`v1.6.551`](https://github.com/PastureStack/server/releases/tag/v1.6.551) is published.
+It retains the eight PCRE2 CVE fixes using the upstream-supported 10.46 backports and
 original Ubuntu packaging. The two rebuilt runtime packages retain ABI, JIT,
-POSIX interfaces and hardening; all other component versions are unchanged.
+POSIX interfaces and hardening. Its standalone Host API archive matches the
+original producer; the incorrect 550 attachment is superseded.
 
 Web Console `1.6.195` and its original runtime SBOM, Engine `v0.183.354`,
 Host API `0.38.8` and Temurin `25.0.5+8` retain their verified inputs.
 The scoped 8080 upgrade and restart passed package/hash/linkage checks,
 regex controls in grep, Git and MariaDB, and three active Host/Agent states.
 Existing configuration, volumes, AppArmor and the previous rollback image remain.
 
-See the [550 release note](docs/releases/server-1.6.550.md) and
-[compatibility contract](COMPATIBILITY.md#server-v16550-pcre2-backports)
-for the immutable identity, publication completion and remaining risks.
+See the [551 release note](docs/releases/server-1.6.551.md) and
+[compatibility contract](COMPATIBILITY.md#server-v16551-release-assets)
+for the immutable identity, verified assets and remaining risks.
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -53,22 +54,22 @@ Maintained CLI `0.6.20` propagates rejected requests as nonzero errors. Legacy `
 ## Quick start
 
 Public GHCR downloads do not require a registry login. Keep all three named volumes.
-The examples below use the published numeric `v1.6.550` tag.
+The examples below use the published numeric `v1.6.551` tag.
 
 ```sh
 docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.550
+  ghcr.io/pasturestack/server:v1.6.551
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.550
+    image: ghcr.io/pasturestack/server:v1.6.551
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/performance/README.md

@@ -20,7 +20,7 @@ evidence is not a performance benchmark; measure the actual workload.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.550
+    image: ghcr.io/pasturestack/server:v1.6.551
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/releases/server-1.6.551.md

@@ -1,39 +1,52 @@
-# Server v1.6.551 candidate
+# Server v1.6.551
 
-Not published.
+Published image:
+`ghcr.io/pasturestack/server:v1.6.551@sha256:150c3eaa2d84df6236e7634843e506a79df71d9e434ad2038427108c14ac358e`.
+Producer: `9abef4712901981e5917c41356bb261974fdba47`.
 
 ## Verified component inputs
 
-This release retains the PCRE2 security backports and all component inputs from
-550, including Web Console 1.6.195, Engine v0.183.354 and Host API 0.38.8.
-No application behavior or database migration is introduced.
-
-The manual completion of 550 accidentally replaced its standalone Host API
-Release attachment with an empty gzip stream while converting an empty browser
-findings table. The image itself contains the correct producer archive. Do not
-use the 550 Host API attachment; the original official Host API 0.38.8 release
-remains valid. The faulty immutable attachment is retained as evidence.
-
-The normal publisher now checks the exact producer archive SHA-256 again after
-report conversion and before upload. Its regression test rejects an empty gzip
-substitution even though that stream is syntactically valid. All downloadable
-archive bytes must match the producer pin; a self-consistent checksum manifest
-alone does not establish that identity.
-
-## Acceptance and remaining risk
-
-Only the release-asset guards and version metadata changed. Original unaffected
-PCRE2 native, consumer, UI and authorization evidence is retained. Normal release
-source, image/security, startup/restart and exact attachment checks still apply.
-8080 deployment and attachment readback are separate acceptance steps. No
-production site, HAProxy, firewall or production database is modified.
-
-The prior scan retains 13 pending LOW/MEDIUM occurrences across 10 CVEs. Other
-product candidates and the Ruby/Onigmo build-host coverage gap remain tracked;
-this release does not claim they have been remediated.
+All component inputs retain the 550 pins, including Web Console 1.6.195,
+Engine v0.183.354, Host API 0.38.8 and the eight PCRE2 CVE backports. No
+application behavior or database migration is introduced.
+
+The manual completion of 550 accidentally converted its standalone Host API
+attachment into an empty gzip while converting an empty browser findings table.
+The 550 image itself contains the correct package. That incorrect immutable
+attachment remains as evidence; do not use it. The original Host API producer
+release remains valid.
+
+The normal publisher rechecks the pinned producer archive SHA-256 after report
+conversion and before upload. Its executed negative fixture rejects an empty
+gzip substitution even though the stream itself is syntactically valid. No
+released image or asset was overwritten.
+
+## Verification and remaining risk
+
+[Run 40120970328](https://github.com/PastureStack/server/actions/runs/40120970328)
+passed the source, image, security, startup/restart and publication checks. All
+33 immutable assets passed anonymous byte/checksum readback, and the Host API
+archive additionally matches producer SHA-256
+`6903ffb6a618f5a9bc8c7c8997a1e0419c93a8bbdeaee6d288957366dccef444`.
+Its archive contents and internal checksums are intact. Both OCI attestations
+bind the exact producer and image digest; the final image retains one layer.
+
+The scoped 8080 cutover and one controlled restart passed. Package integrity and
+linkage, grep/Git and two read-only MariaDB regex controls, ping and three active
+Host/Agent states passed. Existing HostConfig, operator environment, all three
+named data volumes, socket bind and AppArmor were preserved. A consistent
+104-table InnoDB backup and the 550 rollback container/image remain.
+
+The exact rootfs scan retains 51 raw occurrences, 38 VEX dispositions and 13
+pending LOW/MEDIUM occurrences across 10 CVEs. Other product candidates and
+Ruby/Onigmo build-host coverage remain separately tracked. Unchanged UI, role,
+OIDC and MFA evidence is carried forward; no full feature-matrix rerun or
+all-project zero-risk claim is made. The production site, HAProxy, firewall and
+production database were not modified.
 
 ## Upgrade and rollback
 
-Use the new numeric tag after publication and preserve existing configuration,
-named volumes, restart policy and security options. Keep the prior image and
-matching backup for rollback. Do not patch running containers or overwrite tags.
+Use the numeric `v1.6.551` tag after verifying backups and the published image
+identity. Preserve existing Compose settings, named volumes, restart policy and
+security options. Keep the prior image and matching backup until acceptance.
+Do not patch running containers or overwrite release tags.