diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
index aa52ebb217..7d6b3afcae 100644
--- a/COMPATIBILITY.md
+++ b/COMPATIBILITY.md
@@ -2,16 +2,33 @@
-## Server v1.6.554 prepared, not published
+## Server v1.6.554 published
-The candidate integrates Web Console `1.6.196` and Engine `v0.183.355`.
+The published linux/amd64 image is
+`ghcr.io/pasturestack/server:v1.6.554@sha256:8fa087166970ca3670ad4a19b5b90a313041adb503f1a4be9d459e65bc8248a1`,
+produced from `25f5f40f852d7c0cb97b8776bd832d6fce3a89e5` in successful
+[publisher 40862854807](https://github.com/PastureStack/server/actions/runs/40862854807).
+Its distinct OCI config is
+`sha256:249e90384126e9dea1f4d150eb4aeb5be66696f73339c655c7931891b8a0a6ad`.
+All 35 public assets passed anonymous byte/checksum readback; image provenance
+and CycloneDX attestations match this exact digest, source and publication workflow.
+Documentation commits do not change the runtime producer.
+
+The release integrates Web Console `1.6.196` and Engine `v0.183.355`.
The build verifies the browser's enabled capability ceiling and off initial
mode against the exact archive. Backend activation remains explicit.
Seven typed tools share current RBAC and per-Key policy checks; service-upgrade
plans require separate authenticated human approval. No general action proxy
-or approval tool is exposed. See the [candidate note](docs/releases/server-1.6.554.md)
+or approval tool is exposed. See the [release note](docs/releases/server-1.6.554.md)
and [AI collaboration guide](docs/ai-collaboration.md).
-Final publication identities and 8080 acceptance will be recorded after release.
+
+The raw runtime report retains 52 findings. The qualified effective report
+retains ten Medium package occurrences across nine officially unfixed CVEs,
+reviewed again by November 5, 2026. Untracked, High/Critical, available-fix and
+secret counts are zero under the existing release policy. The browser runtime
+SBOM retains its explicitly incomplete coverage.
+Scoped 8080 deployment, the full seven-tool flow and random-marker persistence
+across upgrade and restart remain pending; publication does not establish those results.
diff --git a/README.md b/README.md
index 97202baa23..d43bef5461 100644
--- a/README.md
+++ b/README.md
@@ -11,19 +11,16 @@ upstream history, authorship, licenses, and notices.
-## Current source candidate
+## Current release
-Server `v1.6.554` is a prepared source candidate, not a published image.
+[Server `v1.6.554`](https://github.com/PastureStack/server/releases/tag/v1.6.554) is published.
It integrates Web Console `1.6.196` and Engine `v0.183.355` for optional,
scoped AI collaboration. New pages start with tools off. Upgrade execution
requires an authenticated owner's separate confirmation; ordinary API Keys
retain their existing permissions. It also includes qualified security updates
-for secret delivery and host provisioning. See the [candidate note](docs/releases/server-1.6.554.md).
-
-The previous published release is
-[Server v1.6.553](https://github.com/PastureStack/server/releases/tag/v1.6.553),
-with its [release note](docs/releases/server-1.6.553.md) and
-[immutable identities](COMPATIBILITY.md#server-v16553-brotli).
+for secret delivery and host provisioning. See the [release note](docs/releases/server-1.6.554.md)
+and [verified publication identities](COMPATIBILITY.md#server-v16554-webmcp).
+Scoped deployment and data-retention acceptance on port 8080 remain pending.
Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
@@ -58,8 +55,7 @@ operations, audit records and rollback.
## Quick start
-These examples target the candidate; run them only after its official release.
-This candidate is not yet available from GHCR. Public downloads do not require
+These examples use the published numeric version. Public downloads do not require
a registry login. Keep all three named volumes.
```sh
diff --git a/docs/performance/README.md b/docs/performance/README.md
index 3af4c153af..9179b445f2 100644
--- a/docs/performance/README.md
+++ b/docs/performance/README.md
@@ -8,8 +8,8 @@ The following example is appropriate as a starting point for a dedicated
16-vCPU host with about 32 GiB of RAM. It is not a universal performance
profile; measure the real workload before increasing it further.
-The example targets the Server `v1.6.554` candidate; run it only after its official release and image have been published and read back.
-The candidate is not yet available from GHCR.
+The example uses the published Server `v1.6.554` numeric tag.
+The image and its release assets have passed public identity and checksum readback.
See the [release note](../releases/server-1.6.554.md) and the
[current release](../../README.md#current-release) for component versions and
release details. Preserve the existing runtime overrides and all three named
diff --git a/docs/releases/server-1.6.554.md b/docs/releases/server-1.6.554.md
index cc74067b4c..19b4760cc5 100644
--- a/docs/releases/server-1.6.554.md
+++ b/docs/releases/server-1.6.554.md
@@ -1,8 +1,10 @@
-# Server v1.6.554 candidate
+# Server v1.6.554
-Prepared source only; no Server image or release has been published.
-The release workflow records the final image digest and source
-revision only after its required checks pass.
+Published image: `ghcr.io/pasturestack/server:v1.6.554@sha256:8fa087166970ca3670ad4a19b5b90a313041adb503f1a4be9d459e65bc8248a1`.
+
+Source commit: `25f5f40f852d7c0cb97b8776bd832d6fce3a89e5`.
+
+The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.
## Verified component inputs
@@ -54,6 +56,23 @@ new tools and affected UI, not completion of every existing frontend feature or
the entire planned permission matrix. Rejected pre-confirmation requests are
expected negative tests, not successful upgrades.
+## Publication validation and remaining limits
+
+[Publisher 40862854807](https://github.com/PastureStack/server/actions/runs/40862854807)
+passed source, final-image, startup/restart and security checks. All 35 public
+assets passed anonymous byte/checksum readback. Native image provenance and
+CycloneDX attestations bind the exact source and digest above.
+
+The raw runtime report retains 52 findings; the effective report retains ten
+Medium package occurrences across nine officially unfixed CVEs, with review due
+November 5, 2026. Untracked, High/Critical, available-fix and secret counts are
+zero under the existing policy. The independent browser runtime SBOM retains
+its incomplete coverage; supported npm components have no reported finding.
+
+Scoped 8080 deployment and the full seven-tool flow, including random-marker
+persistence across upgrade and restart, remain pending. These publication
+checks do not establish deployment-specific data retention.
+
## Activation, upgrade and rollback
Follow the [AI collaboration guide](../ai-collaboration.md) for the opt-in backend