Align published 557 instructions and honest workload acceptance

COMPATIBILITY.md

@@ -1,15 +1,27 @@
 # Compatibility Contract
 
-## Server v1.6.557 source candidate
-
-This candidate retains Web Console 1.6.199 and bridge 0.2.1 and consumes the
-qualified Engine 0.183.357 artifact. It repairs decoded internal Key scope reads
-and native process-pool identities. Public typed IDs, live actor ceilings,
-child DENY and ordinary Full access are preserved. See the
-[candidate note](docs/releases/server-1.6.557.md) for exact component inputs,
-unfinished QA and rollback. It is not yet a published or accepted deployment;
-the installation examples below remain on the published 556 image.
-
+<a id="server-v16557-typed-read-fixes"></a>
+
+## Server v1.6.557 published
+
+Published image: `ghcr.io/pasturestack/server:v1.6.557@sha256:801bb93400d6a225952be167a12454023816b725a28ad9770efa4689b12ba2ff`.
+Runtime producer: `9783aacf2b378f39e9dc00469156a57f9eb2e265`; OCI config: `sha256:6e65466bdb73c82ce4bc5c006363ea78f2bf80bcf92c7b729e3f2141e454f4fe`.
+[Publisher 40929617683](https://github.com/PastureStack/server/actions/runs/40929617683)
+passed source, build, real disposable scoped-Key protocol, startup/restart and
+security checks. All 35 public assets passed anonymous byte/SHA256 readback;
+native OCI provenance and CycloneDX attestations passed. Documentation commits
+do not change this producer. The existing exact package policy retains ten
+Medium occurrences across nine officially unfixed CVEs; High/Critical,
+available-fix, untracked and source-secret gates passed. Browser SBOM coverage
+remains incomplete. Designated 8080 browser/workload acceptance is separate.
+
+Web Console 1.6.199 and bridge 0.2.1 are unchanged. Engine 0.183.357 uses original
+CI producer `2cd688b0c066658c41e7d3de5bed8c543687f275` and JAR SHA256
+`a46e832314b32292e3423133168020acf93052a7dd29e967bbaabc3df6dca8dc`.
+It fixes decoded internal scope reads and native process-pool identities while
+preserving public typed IDs, live owner ceilings, child DENY and ordinary Full
+access. [Release boundaries and rollback](docs/releases/server-1.6.557.md) keep
+unfinished full forms, Catalog launch, other batches and KVM HOLD explicit.
 
 <a id="server-v16556-typed-resource-flows"></a>
 

README.md

@@ -13,16 +13,16 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-[Server `v1.6.556`](https://github.com/PastureStack/server/releases/tag/v1.6.556)
-packages Web Console `1.6.199` and Engine `v0.183.356`. It expands optional AI
-collaboration to safe metadata queries and human-reviewed basic workload plans.
-See the [release note](docs/releases/server-1.6.556.md) and
-[publication identities](COMPATIBILITY.md#server-v16556-typed-resource-flows).
+[Server `v1.6.557`](https://github.com/PastureStack/server/releases/tag/v1.6.557)
+packages Web Console `1.6.199` and Engine `v0.183.357`. It repairs scoped AI operation reads and native process-pool metadata while
+retaining live account/Key limits and ordinary UI/API behavior.
+See the [release note](docs/releases/server-1.6.557.md) and
+[publication identities](COMPATIBILITY.md#server-v16557-typed-read-fixes).
 
-Publication and 8080 startup/restart checks passed. New query and workload
-completion integration findings remain under repair; the opt-in expansion is
-not complete frontend coverage. Retained upgrade, data-preservation and session
-evidence does not establish that every new workflow has passed.
+Publication checks include a real scoped-Key preview, human-cookie confirmation,
+empty Stack creation and receipt read on a disposable fresh Server. Deployment
+and browser acceptance are tracked separately; the opt-in expansion is not
+complete frontend coverage. Earlier PASS is retained only where unaffected.
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -52,7 +52,10 @@ The Web Console supports scoped resource discovery and basic Stack, Service and
 Container changes through twelve tools. Plans require normal human review and
 reuse live account and Key permissions. Global Services do not accept a manual
 instance count. Advanced forms and other resource workflows remain pending.
-See the [release note](docs/releases/server-1.6.556.md) and
+Scoped-Key workload retirement has an unresolved integration finding; review
+the [current limitation](docs/ai-collaboration.md#workload-retirement-limitation)
+before enabling these optional changes.
+See the [release note](docs/releases/server-1.6.557.md) and
 [AI collaboration guide](docs/ai-collaboration.md) for activation,
 supported operations, audit records and rollback.
 
@@ -66,15 +69,15 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.556
+  ghcr.io/pasturestack/server:v1.6.557
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.556
+    image: ghcr.io/pasturestack/server:v1.6.557
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/ai-collaboration.md

@@ -1,6 +1,6 @@
 # Optional AI collaboration
 
-Server v1.6.556 combines Web Console 1.6.199 and Engine 0.183.356. The twelve
+Server v1.6.557 combines Web Console 1.6.199 and Engine 0.183.357. The twelve
 supported tools are `list_capabilities`, `find_resources`, `get_resource`,
 `preview_resource_change`, `apply_resource_change`, `find_stacks`,
 `find_services`, `get_service`, `update_service_description`,
@@ -9,6 +9,16 @@ The capability response distinguishes safe metadata, partial coverage and
 pending adapters. This is not complete WebMCP coverage of the console.
 Other platform operations retain their ordinary UI/API paths.
 
+## Workload retirement limitation
+
+Designated 8080 acceptance found that a scoped service downscale can lose its
+service/instance authorization ancestry after the association is retired. The
+later stop is denied and the retired instance can remain `stopping`, even though
+the Service reports its new scale. The source repair is in progress; the full
+typed workload flow is not accepted. Do not broaden a Key or blindly retry an
+uncertain plan to work around this failure. Other completed metadata, create,
+start, scale-up and unchanged layout cases remain separately recorded.
+
 ## Activation
 
 Append the following properties to the deployment's existing `JAVA_OPTS`,

docs/performance/README.md

@@ -8,9 +8,9 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published Server `v1.6.556` numeric tag.
+The example uses the published Server `v1.6.557` numeric tag.
 The image and its release assets have passed public identity and checksum readback.
-See the [release note](../releases/server-1.6.556.md) and the
+See the [release note](../releases/server-1.6.557.md) and the
 [current release](../../README.md#current-release) for component versions and
 release details. Preserve the existing runtime overrides and all three named
 volumes during an upgrade or restart.
@@ -21,7 +21,7 @@ evidence is not a performance benchmark; measure the actual workload.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.556
+    image: ghcr.io/pasturestack/server:v1.6.557
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/releases/server-1.6.557.md

@@ -1,7 +1,10 @@
-# Server v1.6.557 candidate
+# Server v1.6.557
 
-Not published. Install examples continue to use the current published 556 image
-until the immutable 557 publication is verified. Deployment acceptance is pending.
+Published image: `ghcr.io/pasturestack/server:v1.6.557@sha256:801bb93400d6a225952be167a12454023816b725a28ad9770efa4689b12ba2ff`.
+
+Source commit: `9783aacf2b378f39e9dc00469156a57f9eb2e265`.
+
+The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.
 
 ## Verified component inputs
 
@@ -52,3 +55,19 @@ operations. Follow the [Key-policy rollback guide](../upgrades/api-key-policy-ro
 Officially unfixed Medium findings retain their exact package tracking policy;
 the release scan must still reject applicable fixed, High/Critical or untracked
 findings. Browser SBOM coverage remains explicitly incomplete.
+
+## Designated deployment findings
+
+The 8080 installation passed normal cutover, one actual restart and health
+readback with its configuration, volumes and three active Hosts/Agents retained.
+The first scoped Stack-create receipt now succeeds. Twelve remaining metadata
+and paired child-DENY checks passed individually. Sixteen unchanged locale/layout
+cases retain their screenshot hashes, unchanged Web archive and original evidence.
+These are bounded results.
+
+The complete workload journey remains failed: downscaling from two instances to
+one retires the service association before a later stop rechecks authorization,
+leaving the retired instance `stopping` with an `AUTHORIZATION_DENIED` completion.
+The test credential was revoked and removed; the exact test resource ledger is
+retained for source repair and cleanup. See the [current limitation](../ai-collaboration.md#workload-retirement-limitation).
+Do not interpret the new publication protocol gate as whole-workflow acceptance.