Align published Server 556 docs and actual QA evidence

COMPATIBILITY.md

@@ -2,9 +2,23 @@
 
 <a id="server-v16556-typed-resource-flows"></a>
 
-## Server v1.6.556 prepared, not published
-
-Server v1.6.556 source candidate consumes Web Console 1.6.199 (producer
+## Server v1.6.556 published
+
+Published image: `ghcr.io/pasturestack/server:v1.6.556@sha256:31502d8c873c6997682d8c74cd8b1db9ea80b7b74c1c0e8d8e438931185e8316`.
+Runtime producer: `66387f309157fcc64a17e141956eb632a8fcd570`; OCI config: `sha256:60eece627652999f89ce619f934025b3fcf4def4db347adbace87c7992ffa0c9`.
+[Publisher 40918679041](https://github.com/PastureStack/server/actions/runs/40918679041)
+passed source, build, startup/restart and existing security gates. All 35 public
+assets passed anonymous SHA-256 readback; native provenance and CycloneDX
+attestations passed. Later documentation commits do not change this runtime producer.
+The effective scan retains ten Medium occurrences across nine officially unfixed
+CVEs under the unchanged exact package policy; High/Critical, available-fix,
+untracked and secrets counts are zero. Browser SBOM coverage is still incomplete.
+Designated QA startup/restart and affected role/layout checks passed separately;
+new metadata and typed-operation completion findings remain open. See the
+[release note](docs/releases/server-1.6.556.md) for the exact acceptance boundary.
+
+
+Server v1.6.556 consumes Web Console 1.6.199 (producer
 `80a47df65f6406087b80aa81cfa99fe1f438ecff`) and Engine 0.183.356 (producer
 `24cfa1db113f54de3148cd4ac3191e66a1702806`), retaining the other pinned components.
 The matching optional stdio bridge is 0.2.1. Source and release assets record

README.md

@@ -13,13 +13,16 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-[Server `v1.6.555`](https://github.com/PastureStack/server/releases/tag/v1.6.555)
-packages Web Console `1.6.197` and Engine `v0.183.355`. Fresh browser sessions
-restore the authenticated actor for human upgrade-plan review. See the
-[release note](docs/releases/server-1.6.555.md) and
-[publication identities](COMPATIBILITY.md#server-v16555-webmcp-actor).
-Its scoped upgrade, random-marker data-retention, restart and WebSocket
-acceptance is retained separately from subsequent frontend workflow expansion.
+[Server `v1.6.556`](https://github.com/PastureStack/server/releases/tag/v1.6.556)
+packages Web Console `1.6.199` and Engine `v0.183.356`. It expands optional AI
+collaboration to safe metadata queries and human-reviewed basic workload plans.
+See the [release note](docs/releases/server-1.6.556.md) and
+[publication identities](COMPATIBILITY.md#server-v16556-typed-resource-flows).
+
+Publication and 8080 startup/restart checks passed. New query and workload
+completion integration findings remain under repair; the opt-in expansion is
+not complete frontend coverage. Retained upgrade, data-preservation and session
+evidence does not establish that every new workflow has passed.
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -45,13 +48,11 @@ Maintained CLI `0.6.20` propagates rejected requests as nonzero errors. Legacy `
 
 ## Optional AI collaboration
 
-The next Server 1.6.556 source candidate (not yet published) expands to
-Web Console 1.6.199 and Engine 0.183.356. Its Web Console supports scoped resource
-discovery and basic Stack, Service and
+The Web Console supports scoped resource discovery and basic Stack, Service and
 Container changes through twelve tools. Plans require normal human review and
 reuse live account and Key permissions. Global Services do not accept a manual
 instance count. Advanced forms and other resource workflows remain pending.
-See the [candidate note](docs/releases/server-1.6.556.md) and
+See the [release note](docs/releases/server-1.6.556.md) and
 [AI collaboration guide](docs/ai-collaboration.md) for activation,
 supported operations, audit records and rollback.
 
@@ -65,15 +66,15 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.555
+  ghcr.io/pasturestack/server:v1.6.556
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.555
+    image: ghcr.io/pasturestack/server:v1.6.556
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/performance/README.md

@@ -8,9 +8,9 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published Server `v1.6.555` numeric tag.
+The example uses the published Server `v1.6.556` numeric tag.
 The image and its release assets have passed public identity and checksum readback.
-See the [release note](../releases/server-1.6.555.md) and the
+See the [release note](../releases/server-1.6.556.md) and the
 [current release](../../README.md#current-release) for component versions and
 release details. Preserve the existing runtime overrides and all three named
 volumes during an upgrade or restart.
@@ -21,7 +21,7 @@ evidence is not a performance benchmark; measure the actual workload.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.555
+    image: ghcr.io/pasturestack/server:v1.6.556
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/releases/server-1.6.556.md

@@ -1,6 +1,10 @@
-# Server v1.6.556 candidate
+# Server v1.6.556
 
-Prepared source only; no Server image or release has been published.
+Published image: `ghcr.io/pasturestack/server:v1.6.556@sha256:31502d8c873c6997682d8c74cd8b1db9ea80b7b74c1c0e8d8e438931185e8316`.
+
+Source commit: `66387f309157fcc64a17e141956eb632a8fcd570`.
+
+The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.
 
 ## Verified component inputs
 
@@ -58,3 +62,16 @@ unused plans and revoke dedicated bridge Keys before a downgrade. Follow the
 Use normal image/Compose deployment. Do not carry a previous image's
 version-owned environment defaults or a static-bundle runtime patch into the
 new image. Genuine operator overrides and persistent data must be preserved.
+
+## Deployment acceptance boundary
+
+The designated 8080 QA deployment retained its previous image, configuration and
+volumes, passed health and one restart, and retained three active Hosts/Agents.
+Thirty-five affected API role/Key ceiling and cross-ID cases and sixteen new-modal
+locale/layout cases passed. Thirty-four metadata cases passed before two native
+adapter mismatches were found. The first typed Stack creation succeeded, but
+its custom-Key operation read was incorrectly denied; the remaining workload
+sequence is not accepted. These findings are under source repair. Test credentials
+and the exact empty Stack were removed through normal APIs; no runtime patch
+was used. Unaffected earlier PASS remains separate. Full frontend WebMCP
+coverage, remaining resource forms and Catalog launch are still in progress.