Align Server558 README and recorded QA boundaries

COMPATIBILITY.md

@@ -1,14 +1,34 @@
 # Compatibility Contract
 
-## Server v1.6.558 source candidate
-
-The candidate retains Web Console 1.6.199 and bridge 0.2.1, using the qualified
-Engine 0.183.358 artifact to fix scoped managed retirement and native name-query
-pagination. Ordinary Full access, live actor ceilings and explicit child DENY
-remain authoritative. See the [candidate note](docs/releases/server-1.6.558.md)
-for component inputs, required runtime acceptance and rollback. It is not yet
-a published deployment; install examples remain on the published 557 image.
-
+<a id="server-v16558-managed-retirement-and-search"></a>
+
+## Server v1.6.558 published
+
+Published image: `ghcr.io/pasturestack/server:v1.6.558@sha256:c49c4bb1f7bcee2ae0299f196a8332657967fa2ed4e3a3496854f5bca89ec42b`.
+Runtime producer: `33f6056476ee29eb18aa9185e59b4cb3e86c5960`; OCI config:
+`sha256:e9d3df5989c64f947150025935fc970f49289175d1337f21f6360f31bd5db025`.
+[Publisher 40941691098](https://github.com/PastureStack/server/actions/runs/40941691098)
+passed all original source/build, startup/restart, protocol and security gates.
+All 35 public assets passed anonymous SHA256/size readback; native provenance and
+CycloneDX attestations passed. Documentation commits do not change this producer.
+The exact package policy retains ten Medium occurrences across nine officially
+unfixed CVEs; applicable fixed, High/Critical, untracked and secrets gates passed.
+Browser SBOM coverage remains incomplete.
+
+Web Console 1.6.199 and bridge 0.2.1 remain unchanged. Engine 0.183.358 consumes
+original CI producer `1da1f4c37fe43b8c387045c263d286f7db01c574`, JAR SHA256
+`46ad548c6e284a7758eb7f65c85fb5878e2ebdc861ef5c396a00a6510709b733`.
+Its required CI passed 374 suites / 3,631 tests, zero failures/errors and one
+existing conditional skip. Ordinary Full/legacy paths are unchanged.
+
+Designated 8080 upgrade and actual restart preserve operator settings, mounts,
+AppArmor and three active Hosts/Agents. Scoped downscale, Service restart and
+Stack stop/start passed. The full workflow remains failed at individual Service
+stop: the Service is inactive but its container's stop is authorization-denied.
+Five real weak-model cases passed with a separately documented strict oracle
+correction; old failures and unaffected evidence are retained. See the
+[release boundaries](docs/releases/server-1.6.558.md). Catalog/Archive are not
+included; remaining frontend workflows and KVM HOLD are separately tracked.
 
 <a id="server-v16557-typed-read-fixes"></a>
 

README.md

@@ -13,11 +13,12 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-[Server `v1.6.557`](https://github.com/PastureStack/server/releases/tag/v1.6.557)
-packages Web Console `1.6.199` and Engine `v0.183.357`. It repairs scoped AI operation reads and native process-pool metadata while
-retaining live account/Key limits and ordinary UI/API behavior.
-See the [release note](docs/releases/server-1.6.557.md) and
-[publication identities](COMPATIBILITY.md#server-v16557-typed-read-fixes).
+[Server `v1.6.558`](https://github.com/PastureStack/server/releases/tag/v1.6.558)
+packages Web Console `1.6.199` and Engine `v0.183.358`. It repairs scoped managed
+retirement and typed name-query pagination while retaining live account/Key
+limits and ordinary UI/API behavior.
+See the [release note](docs/releases/server-1.6.558.md) and
+[publication identities](COMPATIBILITY.md#server-v16558-managed-retirement-and-search).
 
 Publication checks include a real scoped-Key preview, human-cookie confirmation,
 empty Stack creation and receipt read on a disposable fresh Server. Deployment
@@ -52,10 +53,10 @@ The Web Console supports scoped resource discovery and basic Stack, Service and
 Container changes through twelve tools. Plans require normal human review and
 reuse live account and Key permissions. Global Services do not accept a manual
 instance count. Advanced forms and other resource workflows remain pending.
-Scoped-Key workload retirement has an unresolved integration finding; review
+Individual scoped-Key Service stop has an unresolved integration finding; review
 the [current limitation](docs/ai-collaboration.md#workload-retirement-limitation)
 before enabling these optional changes.
-See the [release note](docs/releases/server-1.6.557.md) and
+See the [release note](docs/releases/server-1.6.558.md) and
 [AI collaboration guide](docs/ai-collaboration.md) for activation,
 supported operations, audit records and rollback.
 
@@ -69,15 +70,15 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.557
+  ghcr.io/pasturestack/server:v1.6.558
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.557
+    image: ghcr.io/pasturestack/server:v1.6.558
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/ai-collaboration.md

@@ -1,6 +1,6 @@
 # Optional AI collaboration
 
-Server v1.6.557 combines Web Console 1.6.199 and Engine 0.183.357. The twelve
+Server v1.6.558 combines Web Console 1.6.199 and Engine 0.183.358. The twelve
 supported tools are `list_capabilities`, `find_resources`, `get_resource`,
 `preview_resource_change`, `apply_resource_change`, `find_stacks`,
 `find_services`, `get_service`, `update_service_description`,
@@ -11,13 +11,13 @@ Other platform operations retain their ordinary UI/API paths.
 
 ## Workload retirement limitation
 
-Designated 8080 acceptance found that a scoped service downscale can lose its
-service/instance authorization ancestry after the association is retired. The
-later stop is denied and the retired instance can remain `stopping`, even though
-the Service reports its new scale. The source repair is in progress; the full
-typed workload flow is not accepted. Do not broaden a Key or blindly retry an
-uncertain plan to work around this failure. Other completed metadata, create,
-start, scale-up and unchanged layout cases remain separately recorded.
+The designated 558 installation fixed the previously observed scoped downscale
+failure. Service restart and Stack stop/start also passed. The complete typed
+workflow remains unaccepted: an individual Service stop can finish its Service
+transition while its container stop is authorization-denied and remains stopping.
+The cause is under source investigation. Do not broaden a Key or blindly replay
+an uncertain plan. Ordinary UI/API paths remain available; other completed
+operations and unchanged layout evidence retain their original scope.
 
 ## Activation
 

docs/performance/README.md

@@ -8,9 +8,9 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published Server `v1.6.557` numeric tag.
+The example uses the published Server `v1.6.558` numeric tag.
 The image and its release assets have passed public identity and checksum readback.
-See the [release note](../releases/server-1.6.557.md) and the
+See the [release note](../releases/server-1.6.558.md) and the
 [current release](../../README.md#current-release) for component versions and
 release details. Preserve the existing runtime overrides and all three named
 volumes during an upgrade or restart.
@@ -21,7 +21,7 @@ evidence is not a performance benchmark; measure the actual workload.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.557
+    image: ghcr.io/pasturestack/server:v1.6.558
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/releases/server-1.6.558.md

@@ -1,7 +1,11 @@
-# Server v1.6.558 candidate
+# Server v1.6.558
 
-Not yet published. Install examples remain on the verified published 557 image
-until immutable 558 publication is verified. New runtime acceptance is pending.
+Published image: `ghcr.io/pasturestack/server:v1.6.558@sha256:c49c4bb1f7bcee2ae0299f196a8332657967fa2ed4e3a3496854f5bca89ec42b`.
+
+Source commit: `33f6056476ee29eb18aa9185e59b4cb3e86c5960`.
+
+The original publisher passed source, security, protocol and startup/restart gates.
+Deployment-specific findings below are separate; publication is not full acceptance.
 
 ## Verified component inputs
 
@@ -57,3 +61,31 @@ Keys. Preserve durable receipts and never replay uncertain operations. See the
 Officially unfixed Medium findings retain exact package tracking; applicable
 fixed, High/Critical, secret or untracked findings still block publication.
 Browser SBOM coverage remains explicitly incomplete.
+
+## Designated deployment findings
+
+The existing QA deployment passed normal upgrade and one actual restart with
+operator overrides, mounts, AppArmor, data and three active Hosts/Agents retained.
+All 35 public assets and native OCI provenance/SBOM attestations were verified.
+
+The complete affected flow remains FAILED. Ten operations completed through
+normal review and eleven approvals were made; individual Service stop then left
+its container stopping with an authorization-denied completion, although the
+Service itself became inactive. Its Key was revoked and removed after the
+failure. Downscale, Service restart and Stack stop/start passed. The exact owned
+Core fixture ledger is retained for source repair; no production site was touched.
+
+Five actual weak-model MCP cases passed: late-row Volume search, exact literal
+command/entry-point arrays, missing-image clarification, same-name disambiguation,
+and stale-reference recovery through the named Stack/Service hierarchy. The fifth
+case originally failed an overly narrow test oracle; its original trace and native
+plan readback prove an equivalent published tool sequence. A separate correction
+retains the original FAILED report and four original PASS records; no model replay
+or approval/apply was performed. Test Keys and six owned weak fixtures were removed
+normally. Their three private OS-volume retirements were proved separately while
+all 479 other recorded Volume identities/states and existing Core fixtures stayed
+unchanged. Original cleanup HOLD evidence is retained with that bounded correction.
+
+Unchanged layout and role evidence is carried forward without rerunning it.
+Catalog launch, Archive/restore, advanced forms, other workflows and KVM HOLD
+are not promoted to accepted coverage by this release.