diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
index 7d6b3afcae..efa4300fd1 100644
--- a/COMPATIBILITY.md
+++ b/COMPATIBILITY.md
@@ -1,5 +1,16 @@
 # Compatibility Contract
 
+<a id="server-v16555-webmcp-actor"></a>
+
+## Server v1.6.555 prepared, not published
+
+This candidate packages Web Console `1.6.197` to restore the authenticated actor
+after a fresh-cookie browser session resumes. The human upgrade-plan inbox can
+then use the current account identity; the separate authenticated confirmation
+requirement is unchanged. Engine `v0.183.355`, role/Key policies, component inputs
+and the existing security baseline remain unchanged. No Server555 image or
+runtime acceptance is claimed yet. See the [candidate note](docs/releases/server-1.6.555.md).
+
 <a id="server-v16554-webmcp"></a>
 
 ## Server v1.6.554 published
@@ -29,6 +40,9 @@ secret counts are zero under the existing release policy. The browser runtime
 SBOM retains its explicitly incomplete coverage.
 Scoped 8080 deployment, the full seven-tool flow and random-marker persistence
 across upgrade and restart remain pending; publication does not establish those results.
+The fresh-cookie UI restore can leave the authenticated account identity unset
+and block the human inbox. This product issue motivates the separate Server555
+candidate; it does not invalidate the recorded Server554 publication evidence.
 
 <a id="server-v16553-brotli"></a>
 
diff --git a/README.md b/README.md
index d43bef5461..7e97294dbe 100644
--- a/README.md
+++ b/README.md
@@ -11,16 +11,19 @@ upstream history, authorship, licenses, and notices.
 
 <a id="current-release"></a>
 
-## Current release
+## Current source candidate
 
-[Server `v1.6.554`](https://github.com/PastureStack/server/releases/tag/v1.6.554) is published.
-It integrates Web Console `1.6.196` and Engine `v0.183.355` for optional,
-scoped AI collaboration. New pages start with tools off. Upgrade execution
-requires an authenticated owner's separate confirmation; ordinary API Keys
-retain their existing permissions. It also includes qualified security updates
-for secret delivery and host provisioning. See the [release note](docs/releases/server-1.6.554.md)
-and [verified publication identities](COMPATIBILITY.md#server-v16554-webmcp).
-Scoped deployment and data-retention acceptance on port 8080 remain pending.
+Server `v1.6.555` is a prepared source candidate, not a published image.
+It packages Web Console `1.6.197`, which restores the authenticated actor when
+a fresh browser session resumes, so human upgrade-plan review can load.
+Engine `v0.183.355`, the dedicated-Key boundary and all other components are
+unchanged. See the [candidate note](docs/releases/server-1.6.555.md).
+
+The current published release is
+[Server v1.6.554](https://github.com/PastureStack/server/releases/tag/v1.6.554),
+with its [release note](docs/releases/server-1.6.554.md) and
+[publication identities and the known UI limitation](COMPATIBILITY.md#server-v16554-webmcp).
+Scoped deployment and random-marker data-retention acceptance remain pending.
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -55,7 +58,8 @@ operations, audit records and rollback.
 
 ## Quick start
 
-These examples use the published numeric version. Public downloads do not require
+These examples target the candidate; run them only after its official release.
+This candidate is not yet available from GHCR. Public downloads do not require
 a registry login. Keep all three named volumes.
 
 ```sh
@@ -63,7 +67,7 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.554
+  ghcr.io/pasturestack/server:v1.6.555
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
@@ -71,7 +75,7 @@ For HTTPS termination at a reverse proxy, set the exact public origin:
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.554
+    image: ghcr.io/pasturestack/server:v1.6.555
     restart: unless-stopped
     ports:
       - "8080:8080"
diff --git a/docs/performance/README.md b/docs/performance/README.md
index 9179b445f2..87ac6fd6f6 100644
--- a/docs/performance/README.md
+++ b/docs/performance/README.md
@@ -8,9 +8,9 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published Server `v1.6.554` numeric tag.
-The image and its release assets have passed public identity and checksum readback.
-See the [release note](../releases/server-1.6.554.md) and the
+The example targets the Server `v1.6.555` candidate; run it only after its official release and image have been published and read back.
+The candidate is not yet available from GHCR.
+See the [release note](../releases/server-1.6.555.md) and the
 [current release](../../README.md#current-release) for component versions and
 release details. Preserve the existing runtime overrides and all three named
 volumes during an upgrade or restart.
@@ -21,7 +21,7 @@ evidence is not a performance benchmark; measure the actual workload.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.554
+    image: ghcr.io/pasturestack/server:v1.6.555
     restart: unless-stopped
     ports:
       - "8080:8080"
diff --git a/docs/releases/server-1.6.555.md b/docs/releases/server-1.6.555.md
new file mode 100644
index 0000000000..fd66651992
--- /dev/null
+++ b/docs/releases/server-1.6.555.md
@@ -0,0 +1,49 @@
+# Server v1.6.555 candidate
+
+Prepared source only; no Server image or release has been published.
+The release workflow records the final image digest and source
+revision only after its required checks pass.
+
+## Verified component inputs
+
+- Web Console `1.6.197`: producer `4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3`,
+  archive SHA256 `f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad`.
+- Engine `v0.183.355`: producer `9ea138d1db1718cf65157c9564c379e62bafe9a0`,
+  `cattle.jar` SHA256 `a7f651f84a9fe6deef2c9f66f50c13c70e450e25f9dfa6fb59129b2681f9f54f`.
+- Secret Delivery API `v0.3.4`: producer `705589989f542669b7e60e1fdab8ae2694ed5d5d`,
+  archive SHA256 `941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010`.
+- Machine Driver Bundle `v0.16.6`: producer `d5bade2722a788f54fe7f3a25af6245336a1e841`,
+  archive SHA256 `82747659c1c9c866ea0d4b5c8909e36f72445f97f13cdc7324c40f403e28a83d`.
+
+## Fresh browser-session actor restoration
+
+Server554 could resume an authenticated fresh-cookie session while its Web
+Console account identity remained unset. The human upgrade-plan inbox was
+therefore blocked even though authentication was enabled. Web Console 1.6.197
+restores the authenticated actor used by that view. Existing roles, dedicated
+API Key policy/revision checks and separate human confirmation remain intact.
+
+The browser artifact retains the enabled capability ceiling with tools initially
+off. The standalone stdio bridge is unchanged. Engine, other component binaries,
+volume lifecycle behavior and all existing security decisions are unchanged.
+Server555 receives its own image and release; Server554 artifacts are not replaced.
+
+## Acceptance boundary
+
+The Web producer completed its focused session-restoration tests and required
+release checks. Server555 must still pass its source, image, startup/restart and
+runtime security gates. The final seven-tool UI flow and a random marker read
+back across upgrade and restart remain separate 8080 acceptance work.
+The earlier Server554 publication passed, but its blocked human-inbox flow
+does not establish complete runtime acceptance or mounted-data preservation.
+The 78 panel layout cases and other unaffected producer evidence are retained;
+this correction does not claim completion of the full permission matrix.
+
+## Activation, upgrade and rollback
+
+Follow the [AI collaboration guide](../ai-collaboration.md). Preserve existing
+environment values, HTTPS origin, ports, AppArmor, restart policy and all three
+named volumes. Do not use `docker compose down -v`. Upgrade plans still require
+separate authenticated human confirmation; a dedicated bridge Key cannot approve
+its own plan. Keep the previous image and a matching database/volume backup.
+The [API Key rollback requirements](../upgrades/api-key-policy-rollback.md) still apply.
diff --git a/scripts/check-server-api-explorer-patch.sh b/scripts/check-server-api-explorer-patch.sh
index 34290863c0..4da5c45034 100755
--- a/scripts/check-server-api-explorer-patch.sh
+++ b/scripts/check-server-api-explorer-patch.sh
@@ -533,7 +533,7 @@ require_marker "$release_dockerfile" \
     SERVER_INCREMENTAL_RELEASE_BASE_MISSING
 for web_sbom_release_marker in \
     'COPY --chmod=0755 artifacts/verify-web-console-sbom.py /usr/local/bin/verify-web-console-sbom' \
-    'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.196-runtime.cdx.json' \
+    'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.197-runtime.cdx.json' \
     '"${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT}" "${WEB_CONSOLE_RUNTIME_SBOM_SHA256}" "${web_sbom}";' \
     '--lock-sha256 "${WEB_CONSOLE_LOCK_SHA256}" --archive "${web_archive}"' \
     '--webmcp-ceiling enabled;' \
@@ -571,7 +571,7 @@ python3 scripts/test-web-console-sbom.py
 python3 server/security/test_web_console_sbom_scan.py
 
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.554' \
+    'ARG SERVER_RELEASE_TAG=v1.6.555' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -629,22 +629,22 @@ require_marker "$publish_workflow" \
     'bash source/server/artifacts/verify-host-api-package.sh' \
     SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.196' \
+    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.197' \
     SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.196.tar.gz' \
+    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.197.tar.gz' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT_SHA256=4f0a550c2754e244cbf77f380c5c138150687988791e063bbf39ce0150d880fa' \
+    'ARG WEB_CONSOLE_ARTIFACT_SHA256=f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad' \
     SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_COMMIT=4e3e4d51db003ef7b456166084d425bfb06e1518' \
+    'ARG WEB_CONSOLE_COMMIT=4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3' \
     SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_LOCK_SHA256=4b9fb2e87352ec76c242b06af3974556b4d7c9f430adb0baccea3f624d3605e6' \
+    'ARG WEB_CONSOLE_LOCK_SHA256=83f664af0919f9ac42c220064a63f6a6f78b5bf7b4ddaf76601d6d973994a464' \
     SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=44b6c1940e4fd364e7a634ac2a6168bc2a0ac3d84b07b9adbc4f6fa2d7e743eb' \
+    'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=04476100b2c764963ed71c33dfb4917e8cb8cae70c5ca0d64d4b34a004b17421' \
     SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING
 require_marker "$release_dockerfile" \
     "grep -aF 'hostsPage.permissionDenied'" \
@@ -653,22 +653,22 @@ require_marker "$release_dockerfile" \
     '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING
 require_marker "$build_script" \
-    'web_console_commit=${WEB_CONSOLE_COMMIT:-4e3e4d51db003ef7b456166084d425bfb06e1518}' \
+    'web_console_commit=${WEB_CONSOLE_COMMIT:-4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING
 require_marker "$build_script" \
-    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.196}' \
+    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.197}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.196.tar.gz}' \
+    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.197.tar.gz}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING
 require_marker "$build_script" \
-    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-4f0a550c2754e244cbf77f380c5c138150687988791e063bbf39ce0150d880fa}' \
+    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING
 require_marker "$build_script" \
-    'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-4b9fb2e87352ec76c242b06af3974556b4d7c9f430adb0baccea3f624d3605e6}' \
+    'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-83f664af0919f9ac42c220064a63f6a6f78b5bf7b4ddaf76601d6d973994a464}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING
 require_marker "$build_script" \
-    'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-44b6c1940e4fd364e7a634ac2a6168bc2a0ac3d84b07b9adbc4f6fa2d7e743eb}' \
+    'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-04476100b2c764963ed71c33dfb4917e8cb8cae70c5ca0d64d4b34a004b17421}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING
 require_marker "$release_dockerfile" \
     'ARG CATALOG_SERVICE_VERSION=0.20.15' \
@@ -1139,10 +1139,10 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.554}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.555}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.554}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.555}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
@@ -1694,10 +1694,10 @@ fi
 if grep -Fxq '## Current source candidate' README.md; then
     for candidate_readme_marker in \
         '<a id="current-release"></a>' \
-        'Server `v1.6.554` is a prepared source candidate, not a published image.' \
+        'Server `v1.6.555` is a prepared source candidate, not a published image.' \
         'run them only after its official release' \
         'This candidate is not yet available' \
-        'ghcr.io/pasturestack/server:v1.6.554'; do
+        'ghcr.io/pasturestack/server:v1.6.555'; do
         require_marker README.md "$candidate_readme_marker" \
             SERVER_CURRENT_CANDIDATE_README_MISSING
     done
@@ -2303,7 +2303,7 @@ done
 jq -e '
   ["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves
   |   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.554"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.555"
   and (.statements | length) == 56
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2341,7 +2341,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.554 >/dev/null
+    "$vendor_pending_fixture" v1.6.555 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2430,4 +2430,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.554 base=v1.6.460 engine=0.183.355 web_console=1.6.196 catalog_service=0.20.15 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.555 base=v1.6.460 engine=0.183.355 web_console=1.6.197 catalog_service=0.20.15 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
diff --git a/scripts/test-current-server-packaging-contract.py b/scripts/test-current-server-packaging-contract.py
index 705c1f60c6..54b816799f 100644
--- a/scripts/test-current-server-packaging-contract.py
+++ b/scripts/test-current-server-packaging-contract.py
@@ -34,16 +34,16 @@
 PUBLISHED_508 = 'Server `v1.6.508` 已正式發布，封裝 Web Console `1.6.171`。'
 STALE_508_CANDIDATE = 'Server `v1.6.508` candidate packages Web Console `1.6.171`'
 COMPATIBILITY_CODE = 'SERVER_CREATE_RESPONSE_ORDER_COMPATIBILITY_MISSING'
-WEB_SHA = '4f0a550c2754e244cbf77f380c5c138150687988791e063bbf39ce0150d880fa'
-WEB_SOURCE = '4e3e4d51db003ef7b456166084d425bfb06e1518'
-WEB_SBOM_SHA = '44b6c1940e4fd364e7a634ac2a6168bc2a0ac3d84b07b9adbc4f6fa2d7e743eb'
-WEB_LOCK_SHA = '4b9fb2e87352ec76c242b06af3974556b4d7c9f430adb0baccea3f624d3605e6'
+WEB_SHA = 'f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad'
+WEB_SOURCE = '4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3'
+WEB_SBOM_SHA = '04476100b2c764963ed71c33dfb4917e8cb8cae70c5ca0d64d4b34a004b17421'
+WEB_LOCK_SHA = '83f664af0919f9ac42c220064a63f6a6f78b5bf7b4ddaf76601d6d973994a464'
 CATALOG_COMMIT = '00eec89e5fdeb9728c1c41babccad8b7dfc8b297'
 ENGINE_SHA = 'a7f651f84a9fe6deef2c9f66f50c13c70e450e25f9dfa6fb59129b2681f9f54f'
 ENGINE_SOURCE = '9ea138d1db1718cf65157c9564c379e62bafe9a0'
 OLD_COORDINATES = {
-    'v1.6.554': 'v1.6.521',
-    '1.6.196': '1.6.181',
+    'v1.6.555': 'v1.6.521',
+    '1.6.197': '1.6.181',
     WEB_SHA: '9199681f2c4311f3fbe8727fcf0f6fa136c9bafe9fbe9d13878c55df442a7a03',
     WEB_SOURCE: '7f2bdad0c90a3241693c2ddd4475202ababba550',
     CATALOG_COMMIT: '7670ffd81d5f0b5570197fb03c7e55b46da45bf3',
@@ -66,23 +66,23 @@
 }
 EXPECTED = {
     COMPATIBILITY_CODE: (COMPATIBILITY, PUBLISHED_508),
-    'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.554'),
+    'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.555'),
     'SERVER_INCREMENTAL_RELEASE_VERSION_MISSING': (DOCKER, 'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"'),
     'SERVER_INCREMENTAL_RELEASE_RUNTIME_VERSION_MISSING': (DOCKER, 'ENV CATTLE_RANCHER_SERVER_VERSION=${SERVER_RELEASE_TAG}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.196'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.196.tar.gz'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.197'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.197.tar.gz'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT_SHA256=' + WEB_SHA),
     'SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_COMMIT=' + WEB_SOURCE),
     'SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_LOCK_SHA256=' + WEB_LOCK_SHA),
     'SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=' + WEB_SBOM_SHA),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING': (BUILD, 'web_console_commit=${WEB_CONSOLE_COMMIT:-' + WEB_SOURCE + '}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.196}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.196.tar.gz}'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.197}'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.197.tar.gz}'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING': (BUILD, 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-' + WEB_SHA + '}'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING': (BUILD, 'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-' + WEB_LOCK_SHA + '}'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING': (BUILD, 'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-' + WEB_SBOM_SHA + '}'),
-    'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.554}'),
-    'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.554}'),
+    'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.555}'),
+    'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.555}'),
     'SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING': (BUILD, 'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"'),
     'SERVER_WEB_CONSOLE_RUNTIME_VERSION_GATE_MISSING': (BUILD, 'test "$(cat "${web_root}/VERSION.txt")" = "${WEB_CONSOLE_RELEASE_TAG}"'),
     'SERVER_VOLUME_NATIVE_READ_ONLY_BUILD_GATE_MISSING': (DOCKER, 'grep -F \'"volume.isNative" : "r"\' >/dev/null'),
@@ -608,15 +608,15 @@ def verify(files, gate=GATE):
                 pipeline = r'(?:^|[;\n])\s*' + re.escape(marker) + r'(?=\s*(?:;|\n|$))'
                 if len(re.findall(pipeline, source)) != 1:
                     raise AssertionError('CURRENT_CATALOG_HASH_BYPASS')
-    if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.554"' not in gate:
+    if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.555"' not in gate:
         raise AssertionError('CURRENT_VEX_GATE_PIN_MISMATCH')
-    if '"$vendor_pending_fixture" v1.6.554 >/dev/null' not in gate:
+    if '"$vendor_pending_fixture" v1.6.555 >/dev/null' not in gate:
         raise AssertionError('CURRENT_VENDOR_GATE_PIN_MISMATCH')
-    if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.554':
+    if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.555':
         raise AssertionError('CURRENT_VEX_RELEASE_MISMATCH')
-    if json.loads(files[VENDOR]).get('release') != 'v1.6.554':
+    if json.loads(files[VENDOR]).get('release') != 'v1.6.555':
         raise AssertionError('CURRENT_VENDOR_RELEASE_MISMATCH')
-    if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.554 base=v1.6.460 engine=0.183.355 web_console=1.6.196 catalog_service=0.20.15 ' not in gate:
+    if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.555 base=v1.6.460 engine=0.183.355 web_console=1.6.197 catalog_service=0.20.15 ' not in gate:
         raise AssertionError('CURRENT_SUMMARY_MISMATCH')
     verify_incremental_contract(files, gate)
     verify_load_balancer_contract(files, gate)
@@ -631,11 +631,11 @@ def previous_gate(gate=GATE):
         if stale(marker) != marker:
             replacements["'" + marker + "' "] = "'" + stale(marker) + "' "
     replacements.update({
-        'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.554"':
+        'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.555"':
             'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.521"',
-        '"$vendor_pending_fixture" v1.6.554 >/dev/null':
+        '"$vendor_pending_fixture" v1.6.555 >/dev/null':
             '"$vendor_pending_fixture" v1.6.521 >/dev/null',
-        'SERVER_API_EXPLORER_PATCH_OK release=v1.6.554 base=v1.6.460 engine=0.183.355 web_console=1.6.196 catalog_service=0.20.15 ':
+        'SERVER_API_EXPLORER_PATCH_OK release=v1.6.555 base=v1.6.460 engine=0.183.355 web_console=1.6.197 catalog_service=0.20.15 ':
             'SERVER_API_EXPLORER_PATCH_OK release=v1.6.521 base=v1.6.460 engine=0.183.340 web_console=1.6.181 catalog_service=0.20.12 ',
     })
     for marker, stale_marker in replacements.items():
@@ -1320,7 +1320,7 @@ def test_historical_engine340_cannot_be_packaged(self):
 
     def test_engine352_actual_war_producer_and_previous351_350_boundary(self):
         candidate = (REPO / 'server/build-component-candidate.sh').read_text(encoding='utf-8')
-        self.assertIn('export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.554}', candidate)
+        self.assertIn('export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.555}', candidate)
         self.assertIn('export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.355}', candidate)
         for old in (
             {'0.183.355': '0.183.351',
@@ -1628,7 +1628,7 @@ def test_machine_actual_binary_package_and_retired_boundary_are_verified(self):
     def test_current_readme_status_specific_prose_does_not_block_publication_transition(self):
         common = GATE.split('for current_readme_marker in ', 1)[1].split('; do', 1)[0]
         self.assertNotIn('candidate', common)
-        self.assertNotIn('v1.6.554', common)
+        self.assertNotIn('v1.6.555', common)
         self.assertIn("grep -Fqi 'keep all three named volumes' README.md", GATE)
         status = GATE.split("if grep -Fxq '## Current source candidate' README.md; then", 1)[1]
         candidate, published = status.split("elif grep -Fxq '## Current release' README.md; then", 1)
@@ -1637,7 +1637,7 @@ def test_current_readme_status_specific_prose_does_not_block_publication_transit
         self.assertIn('This candidate is not yet available', candidate)
         self.assertIn('SERVER_CURRENT_PUBLISHED_README_MISSING', published)
         self.assertNotIn('candidate', published)
-        self.assertNotIn('v1.6.554', published)
+        self.assertNotIn('v1.6.555', published)
 
 
 if __name__ == '__main__':
diff --git a/server/Dockerfile.web-compose-release b/server/Dockerfile.web-compose-release
index 27ed09d4fa..24d44fc83a 100644
--- a/server/Dockerfile.web-compose-release
+++ b/server/Dockerfile.web-compose-release
@@ -90,13 +90,13 @@ ARG PER_HOST_SUBNET_STARTUP_SHA256=f22b41f18d1733c037babed4d2e0474efeedc6017a968
 ARG PER_HOST_SUBNET_PROVENANCE_SHA256=afa2db0e0755c6bd3ee28e111937c521a6d84e6d71d563e99202cf4693000eaf
 
 ARG WEB_CONSOLE_RELEASE_BASE_URL=https://github.com/PastureStack/web-console/releases/download
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.196
-ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.196.tar.gz
-ARG WEB_CONSOLE_ARTIFACT_SHA256=4f0a550c2754e244cbf77f380c5c138150687988791e063bbf39ce0150d880fa
-ARG WEB_CONSOLE_COMMIT=4e3e4d51db003ef7b456166084d425bfb06e1518
-ARG WEB_CONSOLE_LOCK_SHA256=4b9fb2e87352ec76c242b06af3974556b4d7c9f430adb0baccea3f624d3605e6
-ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.196-runtime.cdx.json
-ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=44b6c1940e4fd364e7a634ac2a6168bc2a0ac3d84b07b9adbc4f6fa2d7e743eb
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.197
+ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.197.tar.gz
+ARG WEB_CONSOLE_ARTIFACT_SHA256=f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad
+ARG WEB_CONSOLE_COMMIT=4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3
+ARG WEB_CONSOLE_LOCK_SHA256=83f664af0919f9ac42c220064a63f6a6f78b5bf7b4ddaf76601d6d973994a464
+ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.197-runtime.cdx.json
+ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=04476100b2c764963ed71c33dfb4917e8cb8cae70c5ca0d64d4b34a004b17421
 ARG CATALOG_SERVICE_RELEASE_BASE_URL=https://github.com/PastureStack/catalog-service/releases/download
 ARG CATALOG_SERVICE_VERSION=0.20.15
 ARG CATALOG_SERVICE_COMMIT=6ea547594065f7f95d5877b82f0c1bc553e72640
@@ -696,7 +696,7 @@ ARG PER_HOST_SUBNET_VERSION=0.2.5
 ARG PER_HOST_SUBNET_PRODUCER_COMMIT=e102e0bb38d84b0a9cbf87e5458cf1bc74d01904
 ARG PER_HOST_SUBNET_ARCHIVE_SHA256=7237e83e96a64e7f3de64eb86bff9721c4e879c35cda9e9de1e4cb1ba225f298
 ARG PER_HOST_SUBNET_PROVENANCE_SHA256=afa2db0e0755c6bd3ee28e111937c521a6d84e6d71d563e99202cf4693000eaf
-ARG SERVER_RELEASE_TAG=v1.6.554
+ARG SERVER_RELEASE_TAG=v1.6.555
 ARG API_EXPLORER_RELEASE_TAG=v1.1.20
 ARG API_EXPLORER_ARTIFACT_SHA256=c989ee12a518f6d9d2b23b1f17f48d781aacf6ec31fb65291dd7de9b1661badb
 ARG API_EXPLORER_COMMIT=a586f0dc0aa50df579049a8d4bf26f04400fdf75
@@ -722,11 +722,11 @@ ARG GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4
 ARG GLIBC_RUNTIME_PACKAGE_VERSION=2.43-2ubuntu2.4+pasturestack.1
 ARG PERL_PACKAGE_VERSION=5.40.1-7ubuntu0.3
 ARG PCRE2_PACKAGE_VERSION=10.46-1build1+pasturestack.1
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.196
-ARG WEB_CONSOLE_ARTIFACT_SHA256=4f0a550c2754e244cbf77f380c5c138150687988791e063bbf39ce0150d880fa
-ARG WEB_CONSOLE_COMMIT=4e3e4d51db003ef7b456166084d425bfb06e1518
-ARG WEB_CONSOLE_LOCK_SHA256=4b9fb2e87352ec76c242b06af3974556b4d7c9f430adb0baccea3f624d3605e6
-ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=44b6c1940e4fd364e7a634ac2a6168bc2a0ac3d84b07b9adbc4f6fa2d7e743eb
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.197
+ARG WEB_CONSOLE_ARTIFACT_SHA256=f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad
+ARG WEB_CONSOLE_COMMIT=4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3
+ARG WEB_CONSOLE_LOCK_SHA256=83f664af0919f9ac42c220064a63f6a6f78b5bf7b4ddaf76601d6d973994a464
+ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=04476100b2c764963ed71c33dfb4917e8cb8cae70c5ca0d64d4b34a004b17421
 ARG CATALOG_SERVICE_VERSION=0.20.15
 ARG CATALOG_SERVICE_COMMIT=6ea547594065f7f95d5877b82f0c1bc553e72640
 ARG CATALOG_SERVICE_ARCHIVE_SHA256=7c059101265d897e4b176f503a9217b112946d37d91daa0c40f421fb16e4bb6b
diff --git a/server/build-api-explorer-patch-image.sh b/server/build-api-explorer-patch-image.sh
index 9baacf20c8..a26c7be38c 100755
--- a/server/build-api-explorer-patch-image.sh
+++ b/server/build-api-explorer-patch-image.sh
@@ -14,7 +14,7 @@ if [[ -n "$(git status --porcelain --untracked-files=normal)" ]]; then
 fi
 
 revision=${PASTURESTACK_SERVER_REVISION:-$(git rev-parse HEAD)}
-server_release_tag=${SERVER_RELEASE_TAG:-v1.6.554}
+server_release_tag=${SERVER_RELEASE_TAG:-v1.6.555}
 source_date_epoch=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)}
 base_image=${BASE_IMAGE:-ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403}
 orchestration_engine_release_base_url=${ORCHESTRATION_ENGINE_RELEASE_BASE_URL:-https://github.com/PastureStack/orchestration-engine/releases/download}
@@ -63,13 +63,13 @@ api_explorer_artifact=${API_EXPLORER_ARTIFACT:-api-explorer-1.1.20.tar.gz}
 api_explorer_artifact_sha256=${API_EXPLORER_ARTIFACT_SHA256:-c989ee12a518f6d9d2b23b1f17f48d781aacf6ec31fb65291dd7de9b1661badb}
 api_explorer_commit=${API_EXPLORER_COMMIT:-a586f0dc0aa50df579049a8d4bf26f04400fdf75}
 web_console_release_base_url=${WEB_CONSOLE_RELEASE_BASE_URL:-https://github.com/PastureStack/web-console/releases/download}
-web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.196}
-web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.196.tar.gz}
-web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-4f0a550c2754e244cbf77f380c5c138150687988791e063bbf39ce0150d880fa}
-web_console_commit=${WEB_CONSOLE_COMMIT:-4e3e4d51db003ef7b456166084d425bfb06e1518}
-web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-4b9fb2e87352ec76c242b06af3974556b4d7c9f430adb0baccea3f624d3605e6}
+web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.197}
+web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.197.tar.gz}
+web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad}
+web_console_commit=${WEB_CONSOLE_COMMIT:-4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3}
+web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-83f664af0919f9ac42c220064a63f6a6f78b5bf7b4ddaf76601d6d973994a464}
 web_console_runtime_sbom_artifact=${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT:-web-console-${web_console_release_tag}-runtime.cdx.json}
-web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-44b6c1940e4fd364e7a634ac2a6168bc2a0ac3d84b07b9adbc4f6fa2d7e743eb}
+web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-04476100b2c764963ed71c33dfb4917e8cb8cae70c5ca0d64d4b34a004b17421}
 catalog_service_release_base_url=${CATALOG_SERVICE_RELEASE_BASE_URL:-https://github.com/PastureStack/catalog-service/releases/download}
 catalog_service_version=${CATALOG_SERVICE_VERSION:-0.20.15}
 catalog_service_commit=${CATALOG_SERVICE_COMMIT:-6ea547594065f7f95d5877b82f0c1bc553e72640}
@@ -130,7 +130,7 @@ usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d4
 usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be}
 supported_docker_range='~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0'
 newest_docker_version=v29.8.0
-image=${IMAGE:-pasturestack-validation/server:v1.6.554}
+image=${IMAGE:-pasturestack-validation/server:v1.6.555}
 build_options=()
 
 [[ "$revision" =~ ^[0-9a-f]{40}$ ]]
diff --git a/server/build-component-candidate.sh b/server/build-component-candidate.sh
index 73010beae4..6acc72d8c7 100755
--- a/server/build-component-candidate.sh
+++ b/server/build-component-candidate.sh
@@ -18,10 +18,10 @@ for name in "${required[@]}"; do
     case "$name" in *_COMMIT) [[ ${!name} =~ ^[0-9a-f]{40}$ ]] ;; *) [[ ${!name} =~ ^[0-9a-f]{64}$ ]] ;; esac
     export "$name"
 done
-export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.554}
+export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.555}
 export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.355}
 export ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar
-export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.196}
+export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.197}
 export WEB_CONSOLE_ARTIFACT="web-console-${WEB_CONSOLE_RELEASE_TAG}.tar.gz"
 export WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT:-web-console-${WEB_CONSOLE_RELEASE_TAG}-runtime.cdx.json}
 export WEBSOCKET_PROXY_VERSION=${WEBSOCKET_PROXY_VERSION:-0.23.18}
diff --git a/server/security/openvex.json b/server/security/openvex.json
index b203584272..50e7450d4a 100644
--- a/server/security/openvex.json
+++ b/server/security/openvex.json
@@ -1,9 +1,9 @@
 {
   "@context": "https://openvex.dev/ns/v0.2.0",
-  "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.554",
+  "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.555",
   "author": "PastureStack Security",
-  "timestamp": "2026-10-29T10:54:00Z",
-  "version": 66,
+  "timestamp": "2026-10-29T11:46:38Z",
+  "version": 67,
   "statements": [
     {
       "vulnerability": {
diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json
index e36267215b..1417608674 100644
--- a/server/security/vendor-pending.json
+++ b/server/security/vendor-pending.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "release": "v1.6.554",
+  "release": "v1.6.555",
   "generatedAt": "2026-10-29T09:57:33.809116+00:00",
   "policy": {
     "allowedSeverities": [