diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
index 17c3456562..52cadf381b 100644
--- a/COMPATIBILITY.md
+++ b/COMPATIBILITY.md
@@ -1,5 +1,17 @@
 # Compatibility Contract
 
+## Server v1.6.559 source candidate
+
+Not yet published. README/install examples remain on verified published 558.
+The candidate uses Web Console 1.6.200/optional bridge 0.2.2, Engine 0.183.359,
+Catalog 0.20.17 and Compose 0.14.40 from qualified original CI/public bytes.
+See the [candidate note](docs/releases/server-1.6.559.md) for exact source,
+archive/binary/SBOM/lock identities and four independent opt-ins.
+Core200, Catalog/Archive, affected roles/layouts/weak-model checks, three
+Hosts/Agents and an actual restart remain pending. Existing performance,
+origin, volume and rollback rules remain; this is not full frontend coverage.
+
+
 <a id="server-v16558-managed-retirement-and-search"></a>
 
 ## Server v1.6.558 published
diff --git a/docs/releases/server-1.6.559.md b/docs/releases/server-1.6.559.md
new file mode 100644
index 0000000000..6c2e0cc7f3
--- /dev/null
+++ b/docs/releases/server-1.6.559.md
@@ -0,0 +1,120 @@
+# Server v1.6.559 candidate
+
+Not yet published. README/install examples remain on verified published 558.
+Qualified component inputs do not establish Server559 runtime acceptance.
+
+## Verified component inputs
+
+Values below come from qualified CI and anonymous publication receipts, never
+from a documentation merge head or rebuilt artifact. Web200 includes optional
+bridge 0.2.2. Catalog/Compose SBOM and Go lock identities are retained explicitly;
+their existing Server consumer contract pins original archive/binary bytes.
+No unused ARG is invented to imply an additional consumer check.
+
+### Web
+
+- version: 1.6.200
+- producer: 03e0d7b25b8dfcbc45baecf6d448834016aac649
+- archive: web-console-1.6.200.tar.gz
+- archiveSha256: 97fe46c426cb83263fcfc7f5884c15ca90f7ec3ebec71d9ca023d8b7ad2665c0
+- runtimeSbomSha256: 0ce1f6b99e1e449c545d3d7df65302fdb58d1974fecea6477b20262c2148921c
+- lockSha256: 1797dd27bb7b1c6b86b8689435e916b03523a9fdf45c5178ec7c2ea05706d4bd
+- bridgeVersion: 0.2.2
+- bridgeArchiveSha256: f6c2e4496aaa629925cbfc3217b7bdbfb96d710e9c51899bb8b15d8704c8da7c
+- bridgeSbomSha256: dde9f55749b3d5d1d680fe0b334d7b4fb9b3fed10aa59abd4cd4a4cbeba6a723
+
+### Catalog
+
+- version: 0.20.17
+- producer: 2f70559e340865eb6243662ed33d8cbc7b1efa90
+- archive: catalog-service-0.20.17.tar.xz
+- archiveSha256: 4f83f89763ce325262baf8984782da2c21fd81e3cc22c0a1c76aaa50b2a50f20
+- binariesSha256.catalog-service: f2a63056d5d48e032bdfd0dbcbe1b2254f6353f1a76125f86a72a31ec532da45
+- binariesSha256.catalog-service-sqlite: 94bd4729bd129c333435ab98963080f44d08bec00f814442c99c390ec97b46ce
+- runtimeSbomSha256: 293e5938cb4aa0192ea2b29ee42ed36a5d39302f6785c9cfbed2a2d5bfc05c12
+- goModSha256: d799cfa1b6acbe44b78027c56bfbaee88a06bd8894d220e61cce340e85dc1f66
+- goSumSha256: 5f658cccf768ab6fa548d1ee7cd8fb371d32e7471d46a6a31470fba31ca925c5
+- licenseSha256: 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
+- metadata: catalog-2017-release-metadata.json
+- metadataSha256: ac783ff2c6b7b7a3376dfcb0b5034066d989d80cbf83b81c62af3df45134f517
+
+### Compose
+
+- version: 0.14.40
+- producer: 1835f8db645a8488e327b1f6e750bfdf3d1fb84d
+- archive: compose-executor-0.14.40-linux-amd64.gz
+- archiveSha256: fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732
+- binariesSha256.compose-executor: a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc
+- runtimeSbomSha256: 4f8f477bfd6f4de63c2f51bc5977073dd63ac696dbf3749cebb79b1a3158bc7b
+- goModSha256: c99c5d17dd458110a5feee3dbb8114f6125dad884bd5a9f0d94e27a5c8f60fca
+- goSumSha256: 55bd76f3c5fef3851d40aea2fee602d452f06ac8f452d7d5053897e7bdfbde1a
+- metadata: compose-1440-release-metadata.json
+- metadataSha256: 1ccb7ef5ec9cb0f1c189f6d32dea029ec493679a5c08ec6c24a36eba8b454fa6
+
+### Engine
+
+- version: v0.183.359
+- producer: eac3fde5fc7779b6107e2702785120a9c591927b
+- tagSource: c11979a7426d942df3035583e4d0dea8f1a2553f
+- artifactSha256: 07e7de2548bd98d5209bf3594d69fe5b9a5d7ddba36eed4b6b6e4406022c3f90
+- runtimeSbomSha256: e0c3e7391370b1525517fc9335143db882b48b47e49c8ffd0f1df9c0436f1be1
+- schemaSha256.readonly: 7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233
+- schemaSha256.restricted: f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51
+- tests.suiteCount: 396
+- tests.errors: 0
+- tests.failures: 0
+- tests.skipped: 1
+- tests.tests: 3748
+- workflowRun: 40966528986
+
+## Included behavior and boundaries
+
+The assembly includes opt-in typed Archive/restore and the first bounded
+Catalog-to-new-Stack workflow with matching Catalog 0.20.17/Compose 0.14.40 owners.
+Public tools never receive private Compose, question defaults, human secrets or
+internal delegation proofs. Native owner validation, fresh actor/role/Key
+ceilings, exact source/reference binding, human-cookie input/confirmation and
+durable claim/receipt semantics remain. Restore neither starts resources nor
+recursively restores children; existing stopped/system/parent rules still apply.
+
+Scoped managed cleanup accepts only exact engine-captured legal parent-state
+progress with UUID/owner/mapping/Key protections. Terminal AUTHORIZATION_DENIED
+produces a safe failed receipt. Cancelled chains/uncertain writes are not replayed.
+The original 558 Service-stop failure and fixture/transport/oracle histories
+remain recorded; prior partial successes are not promoted to full workflow PASS.
+
+## Required new acceptance: pending
+
+Core Web200 lifecycle/receipt completion; Archive/restore including concurrency;
+Catalog safe options, explicit human inputs/references, confirmation, launch and
+completion; affected roles/Key denies, browser layouts and weak-model cases are
+pending on the assembled Server. Designated 8080 must retain three healthy
+Hosts/Agents and pass one actual helper restart, same operation/settings, and
+first-generated random marker bytes on mounted storage. Earlier role/read/
+layout/weak evidence carries only its original unaffected scope. This does not
+complete all 243 business/query groups. Browser SBOM coverage remains incomplete.
+
+## Opt-ins, performance and rollback
+
+Preserve independent `api.ai.bridge.enabled`,
+`api.ai.service.upgrade.enabled` and `api.ai.resource.change.enabled`.
+The fourth opt-in is `api.ai.catalog.launch.enabled`; never enable it implicitly
+or treat it as a permission grant. Normal Full/general and human UI/API routes
+keep their existing contracts.
+
+Preserve HTTPS/origin, MFA/session, operator settings, JVM performance settings,
+mounts, AppArmor and all named/data volumes. At cutover reconcile new image
+defaults with genuine operator deltas; do not copy old image-owned environment
+values. This assembly does not change production, firewalls or authentication settings.
+
+Back up the database and volumes, verify restore and retain the previous image/
+container rollback point. Settle accepted work, cancel unused plans and revoke
+temporary Keys before rollback. Keep durable receipts; never replay unknown
+writes. Rollback may require a matching database backup. Do not remove volumes
+or drop plan data. See the [upgrade guide](../upgrades/README.md) and
+[Key rollback guide](../upgrades/api-key-policy-rollback.md).
+
+Other component pins and all security statements remain unchanged. Ten Medium
+occurrences across nine officially unfixed CVEs retain exact vendor tracking.
+Applicable fixed, High/Critical, secret or untracked findings block publication.
+No VEX exception is added.
diff --git a/scripts/check-server-api-explorer-patch.sh b/scripts/check-server-api-explorer-patch.sh
index 1008d55e1a..ca69ed6fc6 100755
--- a/scripts/check-server-api-explorer-patch.sh
+++ b/scripts/check-server-api-explorer-patch.sh
@@ -533,7 +533,7 @@ require_marker "$release_dockerfile" \
     SERVER_INCREMENTAL_RELEASE_BASE_MISSING
 for web_sbom_release_marker in \
     'COPY --chmod=0755 artifacts/verify-web-console-sbom.py /usr/local/bin/verify-web-console-sbom' \
-    'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.199-runtime.cdx.json' \
+    'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.200-runtime.cdx.json' \
     '"${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT}" "${WEB_CONSOLE_RUNTIME_SBOM_SHA256}" "${web_sbom}";' \
     '--lock-sha256 "${WEB_CONSOLE_LOCK_SHA256}" --archive "${web_archive}"' \
     '--webmcp-ceiling enabled;' \
@@ -571,7 +571,7 @@ python3 scripts/test-web-console-sbom.py
 python3 server/security/test_web_console_sbom_scan.py
 
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.558' \
+    'ARG SERVER_RELEASE_TAG=v1.6.559' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -629,22 +629,22 @@ require_marker "$publish_workflow" \
     'bash source/server/artifacts/verify-host-api-package.sh' \
     SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.199' \
+    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.200' \
     SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.199.tar.gz' \
+    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.200.tar.gz' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT_SHA256=ab60d4baa10685021b74db09b805dee1f866e9bd0fbccea4d54610df907c7570' \
+    'ARG WEB_CONSOLE_ARTIFACT_SHA256=97fe46c426cb83263fcfc7f5884c15ca90f7ec3ebec71d9ca023d8b7ad2665c0' \
     SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_COMMIT=80a47df65f6406087b80aa81cfa99fe1f438ecff' \
+    'ARG WEB_CONSOLE_COMMIT=03e0d7b25b8dfcbc45baecf6d448834016aac649' \
     SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_LOCK_SHA256=e9f88f608cd4d516a69141464a6eb853ec1179bb86415979fad0569cdfa88173' \
+    'ARG WEB_CONSOLE_LOCK_SHA256=1797dd27bb7b1c6b86b8689435e916b03523a9fdf45c5178ec7c2ea05706d4bd' \
     SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=324948a11348729a334864c04850a77b2e5c4643546168ee7b8c7289e983ac31' \
+    'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=0ce1f6b99e1e449c545d3d7df65302fdb58d1974fecea6477b20262c2148921c' \
     SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING
 require_marker "$release_dockerfile" \
     "grep -aF 'hostsPage.permissionDenied'" \
@@ -653,52 +653,52 @@ require_marker "$release_dockerfile" \
     '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING
 require_marker "$build_script" \
-    'web_console_commit=${WEB_CONSOLE_COMMIT:-80a47df65f6406087b80aa81cfa99fe1f438ecff}' \
+    'web_console_commit=${WEB_CONSOLE_COMMIT:-03e0d7b25b8dfcbc45baecf6d448834016aac649}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING
 require_marker "$build_script" \
-    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.199}' \
+    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.200}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.199.tar.gz}' \
+    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.200.tar.gz}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING
 require_marker "$build_script" \
-    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-ab60d4baa10685021b74db09b805dee1f866e9bd0fbccea4d54610df907c7570}' \
+    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-97fe46c426cb83263fcfc7f5884c15ca90f7ec3ebec71d9ca023d8b7ad2665c0}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING
 require_marker "$build_script" \
-    'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-e9f88f608cd4d516a69141464a6eb853ec1179bb86415979fad0569cdfa88173}' \
+    'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-1797dd27bb7b1c6b86b8689435e916b03523a9fdf45c5178ec7c2ea05706d4bd}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING
 require_marker "$build_script" \
-    'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-324948a11348729a334864c04850a77b2e5c4643546168ee7b8c7289e983ac31}' \
+    'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-0ce1f6b99e1e449c545d3d7df65302fdb58d1974fecea6477b20262c2148921c}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG CATALOG_SERVICE_VERSION=0.20.15' \
+    'ARG CATALOG_SERVICE_VERSION=0.20.17' \
     SERVER_INCREMENTAL_CATALOG_VERSION_MISSING
 require_marker "$build_script" \
-    'catalog_service_version=${CATALOG_SERVICE_VERSION:-0.20.15}' \
+    'catalog_service_version=${CATALOG_SERVICE_VERSION:-0.20.17}' \
     SERVER_INCREMENTAL_CATALOG_BUILD_VERSION_MISSING
 require_marker "$release_dockerfile" \
-    'ARG CATALOG_SERVICE_COMMIT=6ea547594065f7f95d5877b82f0c1bc553e72640' \
+    'ARG CATALOG_SERVICE_COMMIT=2f70559e340865eb6243662ed33d8cbc7b1efa90' \
     SERVER_INCREMENTAL_CATALOG_COMMIT_MISSING
 require_marker "$build_script" \
-    'catalog_service_commit=${CATALOG_SERVICE_COMMIT:-6ea547594065f7f95d5877b82f0c1bc553e72640}' \
+    'catalog_service_commit=${CATALOG_SERVICE_COMMIT:-2f70559e340865eb6243662ed33d8cbc7b1efa90}' \
     SERVER_INCREMENTAL_CATALOG_BUILD_COMMIT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG CATALOG_SERVICE_ARCHIVE_SHA256=7c059101265d897e4b176f503a9217b112946d37d91daa0c40f421fb16e4bb6b' \
+    'ARG CATALOG_SERVICE_ARCHIVE_SHA256=4f83f89763ce325262baf8984782da2c21fd81e3cc22c0a1c76aaa50b2a50f20' \
     SERVER_INCREMENTAL_CATALOG_ARCHIVE_SHA256_MISSING
 require_marker "$build_script" \
-    'catalog_service_archive_sha256=${CATALOG_SERVICE_ARCHIVE_SHA256:-7c059101265d897e4b176f503a9217b112946d37d91daa0c40f421fb16e4bb6b}' \
+    'catalog_service_archive_sha256=${CATALOG_SERVICE_ARCHIVE_SHA256:-4f83f89763ce325262baf8984782da2c21fd81e3cc22c0a1c76aaa50b2a50f20}' \
     SERVER_INCREMENTAL_CATALOG_BUILD_ARCHIVE_SHA256_MISSING
 require_marker "$release_dockerfile" \
-    'ARG CATALOG_SERVICE_BINARY_SHA256=948a528987113a2d37f5ee519c4f682e09af4aa10ff64d490d9851ba7b633364' \
+    'ARG CATALOG_SERVICE_BINARY_SHA256=f2a63056d5d48e032bdfd0dbcbe1b2254f6353f1a76125f86a72a31ec532da45' \
     SERVER_INCREMENTAL_CATALOG_BINARY_SHA256_MISSING
 require_marker "$build_script" \
-    'catalog_service_binary_sha256=${CATALOG_SERVICE_BINARY_SHA256:-948a528987113a2d37f5ee519c4f682e09af4aa10ff64d490d9851ba7b633364}' \
+    'catalog_service_binary_sha256=${CATALOG_SERVICE_BINARY_SHA256:-f2a63056d5d48e032bdfd0dbcbe1b2254f6353f1a76125f86a72a31ec532da45}' \
     SERVER_INCREMENTAL_CATALOG_BUILD_BINARY_SHA256_MISSING
 require_marker "$release_dockerfile" \
-    'ARG CATALOG_SERVICE_SQLITE_BINARY_SHA256=b890cfc7941ad3ba1bde4038c0acde4098fa101512553159d4615e540f8bb659' \
+    'ARG CATALOG_SERVICE_SQLITE_BINARY_SHA256=94bd4729bd129c333435ab98963080f44d08bec00f814442c99c390ec97b46ce' \
     SERVER_INCREMENTAL_CATALOG_SQLITE_BINARY_SHA256_MISSING
 require_marker "$build_script" \
-    'catalog_service_sqlite_binary_sha256=${CATALOG_SERVICE_SQLITE_BINARY_SHA256:-b890cfc7941ad3ba1bde4038c0acde4098fa101512553159d4615e540f8bb659}' \
+    'catalog_service_sqlite_binary_sha256=${CATALOG_SERVICE_SQLITE_BINARY_SHA256:-94bd4729bd129c333435ab98963080f44d08bec00f814442c99c390ec97b46ce}' \
     SERVER_INCREMENTAL_CATALOG_BUILD_SQLITE_BINARY_SHA256_MISSING
 require_marker "$release_dockerfile" \
     'ARG CATALOG_SERVICE_LICENSE_SHA256=0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594' \
@@ -750,8 +750,8 @@ for incremental_producer_marker in \
     'ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628' \
     'ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866' \
     'ARG USAGE_TELEMETRY_AGENT_BINARY_SHA256=90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be' \
-    'ARG COMPOSE_EXECUTOR_COMMIT=53a33bdc13ae99f4bc4a2dc5cc760b6b2d098388' \
-    'ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=4ab4685af67a8b8b11f3dd4996de9e087c26391ec401cf02cdcafe4c93094bab'; do
+    'ARG COMPOSE_EXECUTOR_COMMIT=1835f8db645a8488e327b1f6e750bfdf3d1fb84d' \
+    'ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732'; do
     require_marker "$release_dockerfile" "$incremental_producer_marker" \
         SERVER_INCREMENTAL_RUNTIME_PRODUCER_PIN_MISSING
 done
@@ -768,10 +768,10 @@ for incremental_producer_build_marker in \
     'usage_telemetry_agent_commit=${USAGE_TELEMETRY_AGENT_COMMIT:-4ee641bc1273cf582a77609af71d00b72f17b628}' \
     'usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866}' \
     'usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be}' \
-    'compose_executor_version=${COMPOSE_EXECUTOR_VERSION:-0.14.39}' \
-    'compose_executor_commit=${COMPOSE_EXECUTOR_COMMIT:-53a33bdc13ae99f4bc4a2dc5cc760b6b2d098388}' \
-    'compose_executor_archive_sha256=${COMPOSE_EXECUTOR_ARCHIVE_SHA256:-4ab4685af67a8b8b11f3dd4996de9e087c26391ec401cf02cdcafe4c93094bab}' \
-    'compose_executor_binary_sha256=${COMPOSE_EXECUTOR_BINARY_SHA256:-0f0c0ada23564572b569e1c73951ca363c0dc262fe7bba9c2474106650c4eac5}'; do
+    'compose_executor_version=${COMPOSE_EXECUTOR_VERSION:-0.14.40}' \
+    'compose_executor_commit=${COMPOSE_EXECUTOR_COMMIT:-1835f8db645a8488e327b1f6e750bfdf3d1fb84d}' \
+    'compose_executor_archive_sha256=${COMPOSE_EXECUTOR_ARCHIVE_SHA256:-fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732}' \
+    'compose_executor_binary_sha256=${COMPOSE_EXECUTOR_BINARY_SHA256:-a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc}'; do
     require_marker "$build_script" "$incremental_producer_build_marker" \
         SERVER_INCREMENTAL_RUNTIME_PRODUCER_BUILD_PIN_MISSING
 done
@@ -998,10 +998,10 @@ for release_webhook_build_marker in \
         SERVER_INCREMENTAL_WEBHOOK_BUILD_GATE_MISSING
 done
 require_marker "$release_dockerfile" \
-    'ARG COMPOSE_EXECUTOR_VERSION=0.14.39' \
+    'ARG COMPOSE_EXECUTOR_VERSION=0.14.40' \
     SERVER_INCREMENTAL_COMPOSE_VERSION_MISSING
 require_marker "$release_dockerfile" \
-    'ARG COMPOSE_EXECUTOR_BINARY_SHA256=0f0c0ada23564572b569e1c73951ca363c0dc262fe7bba9c2474106650c4eac5' \
+    'ARG COMPOSE_EXECUTOR_BINARY_SHA256=a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc' \
     SERVER_INCREMENTAL_COMPOSE_HASH_MISSING
 require_marker "$release_dockerfile" \
     'tar --no-same-owner --no-same-permissions -xzf "${web_archive}"' \
@@ -1139,21 +1139,21 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.558}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.559}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.558}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.559}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
     SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING
 for release_engine_marker in \
-    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.358' \
+    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.359' \
     'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar' \
-    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=46ad548c6e284a7758eb7f65c85fb5878e2ebdc861ef5c396a00a6510709b733' \
-    'ARG ORCHESTRATION_ENGINE_COMMIT=1da1f4c37fe43b8c387045c263d286f7db01c574' \
+    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=07e7de2548bd98d5209bf3594d69fe5b9a5d7ddba36eed4b6b6e4406022c3f90' \
+    'ARG ORCHESTRATION_ENGINE_COMMIT=eac3fde5fc7779b6107e2702785120a9c591927b' \
     'COPY --from=release_artifacts /out/orchestration-engine.jar /tmp/orchestration-engine.jar' \
-    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.358' \
+    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.359' \
     'sh /usr/share/cattle/verify-engine-archive.sh "${archive}" "${ORCHESTRATION_ENGINE_VERSION}" "${ORCHESTRATION_ENGINE_ARTIFACT_SHA256}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar' \
@@ -1172,10 +1172,10 @@ for release_engine_marker in \
         SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING
 done
 for release_engine_build_marker in \
-    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.358}' \
+    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.359}' \
     'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}' \
-    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-46ad548c6e284a7758eb7f65c85fb5878e2ebdc861ef5c396a00a6510709b733}' \
-    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-1da1f4c37fe43b8c387045c263d286f7db01c574}' \
+    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-07e7de2548bd98d5209bf3594d69fe5b9a5d7ddba36eed4b6b6e4406022c3f90}' \
+    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-eac3fde5fc7779b6107e2702785120a9c591927b}' \
     'CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     '< "${server_dir}/artifacts/verify-engine-archive.sh"'; do
@@ -1694,10 +1694,10 @@ fi
 if grep -Fxq '## Current source candidate' README.md; then
     for candidate_readme_marker in \
         '<a id="current-release"></a>' \
-        'Server `v1.6.558` is a prepared source candidate, not a published image.' \
+        'Server `v1.6.559` is a prepared source candidate, not a published image.' \
         'run them only after its official release' \
         'This candidate is not yet available' \
-        'ghcr.io/pasturestack/server:v1.6.558'; do
+        'ghcr.io/pasturestack/server:v1.6.559'; do
         require_marker README.md "$candidate_readme_marker" \
             SERVER_CURRENT_CANDIDATE_README_MISSING
     done
@@ -2303,7 +2303,7 @@ done
 jq -e '
   ["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves
   |   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.558"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.559"
   and (.statements | length) == 56
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2341,7 +2341,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.558 >/dev/null
+    "$vendor_pending_fixture" v1.6.559 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2430,4 +2430,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.558 base=v1.6.460 engine=0.183.358 web_console=1.6.199 catalog_service=0.20.15 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.559 base=v1.6.460 engine=0.183.359 web_console=1.6.200 catalog_service=0.20.17 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
diff --git a/scripts/test-current-server-packaging-contract.py b/scripts/test-current-server-packaging-contract.py
index 565f1fe89d..f139ed7b70 100644
--- a/scripts/test-current-server-packaging-contract.py
+++ b/scripts/test-current-server-packaging-contract.py
@@ -34,16 +34,16 @@
 PUBLISHED_508 = 'Server `v1.6.508` 已正式發布，封裝 Web Console `1.6.171`。'
 STALE_508_CANDIDATE = 'Server `v1.6.508` candidate packages Web Console `1.6.171`'
 COMPATIBILITY_CODE = 'SERVER_CREATE_RESPONSE_ORDER_COMPATIBILITY_MISSING'
-WEB_SHA = 'ab60d4baa10685021b74db09b805dee1f866e9bd0fbccea4d54610df907c7570'
-WEB_SOURCE = '80a47df65f6406087b80aa81cfa99fe1f438ecff'
-WEB_SBOM_SHA = '324948a11348729a334864c04850a77b2e5c4643546168ee7b8c7289e983ac31'
-WEB_LOCK_SHA = 'e9f88f608cd4d516a69141464a6eb853ec1179bb86415979fad0569cdfa88173'
+WEB_SHA = '97fe46c426cb83263fcfc7f5884c15ca90f7ec3ebec71d9ca023d8b7ad2665c0'
+WEB_SOURCE = '03e0d7b25b8dfcbc45baecf6d448834016aac649'
+WEB_SBOM_SHA = '0ce1f6b99e1e449c545d3d7df65302fdb58d1974fecea6477b20262c2148921c'
+WEB_LOCK_SHA = '1797dd27bb7b1c6b86b8689435e916b03523a9fdf45c5178ec7c2ea05706d4bd'
 CATALOG_COMMIT = '00eec89e5fdeb9728c1c41babccad8b7dfc8b297'
-ENGINE_SHA = '46ad548c6e284a7758eb7f65c85fb5878e2ebdc861ef5c396a00a6510709b733'
-ENGINE_SOURCE = '1da1f4c37fe43b8c387045c263d286f7db01c574'
+ENGINE_SHA = '07e7de2548bd98d5209bf3594d69fe5b9a5d7ddba36eed4b6b6e4406022c3f90'
+ENGINE_SOURCE = 'eac3fde5fc7779b6107e2702785120a9c591927b'
 OLD_COORDINATES = {
-    'v1.6.558': 'v1.6.521',
-    '1.6.199': '1.6.181',
+    'v1.6.559': 'v1.6.521',
+    '1.6.200': '1.6.181',
     WEB_SHA: '9199681f2c4311f3fbe8727fcf0f6fa136c9bafe9fbe9d13878c55df442a7a03',
     WEB_SOURCE: '7f2bdad0c90a3241693c2ddd4475202ababba550',
     CATALOG_COMMIT: '7670ffd81d5f0b5570197fb03c7e55b46da45bf3',
@@ -52,37 +52,37 @@
 # Published521 component values remain mutation controls.
 # Component coordinates do not establish Server545 artifact/runtime PASS.
 CATALOG_FIELDS = (
-    ('VERSION', 'version', '0.20.15'),
-    ('COMMIT', 'commit', '6ea547594065f7f95d5877b82f0c1bc553e72640'),
-    ('ARCHIVE_SHA256', 'archive_sha256', '7c059101265d897e4b176f503a9217b112946d37d91daa0c40f421fb16e4bb6b'),
-    ('BINARY_SHA256', 'binary_sha256', '948a528987113a2d37f5ee519c4f682e09af4aa10ff64d490d9851ba7b633364'),
-    ('SQLITE_BINARY_SHA256', 'sqlite_binary_sha256', 'b890cfc7941ad3ba1bde4038c0acde4098fa101512553159d4615e540f8bb659'),
+    ('VERSION', 'version', '0.20.17'),
+    ('COMMIT', 'commit', '2f70559e340865eb6243662ed33d8cbc7b1efa90'),
+    ('ARCHIVE_SHA256', 'archive_sha256', '4f83f89763ce325262baf8984782da2c21fd81e3cc22c0a1c76aaa50b2a50f20'),
+    ('BINARY_SHA256', 'binary_sha256', 'f2a63056d5d48e032bdfd0dbcbe1b2254f6353f1a76125f86a72a31ec532da45'),
+    ('SQLITE_BINARY_SHA256', 'sqlite_binary_sha256', '94bd4729bd129c333435ab98963080f44d08bec00f814442c99c390ec97b46ce'),
     ('LICENSE_SHA256', 'license_sha256', '0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594'),
 )
 LEGACY_ENGINE_COORDINATES = {
-    '0.183.358': '0.183.337',
+    '0.183.359': '0.183.337',
     ENGINE_SHA: '7e45189f2b57097efc7929c04ddf7767aebbe027d1b9f90023aa6711522c5c80',
     ENGINE_SOURCE: 'ba041fe312dfe97fc1e5144af576ddcf1b573d8e',
 }
 EXPECTED = {
     COMPATIBILITY_CODE: (COMPATIBILITY, PUBLISHED_508),
-    'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.558'),
+    'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.559'),
     'SERVER_INCREMENTAL_RELEASE_VERSION_MISSING': (DOCKER, 'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"'),
     'SERVER_INCREMENTAL_RELEASE_RUNTIME_VERSION_MISSING': (DOCKER, 'ENV CATTLE_RANCHER_SERVER_VERSION=${SERVER_RELEASE_TAG}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.199'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.199.tar.gz'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.200'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.200.tar.gz'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT_SHA256=' + WEB_SHA),
     'SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_COMMIT=' + WEB_SOURCE),
     'SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_LOCK_SHA256=' + WEB_LOCK_SHA),
     'SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=' + WEB_SBOM_SHA),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING': (BUILD, 'web_console_commit=${WEB_CONSOLE_COMMIT:-' + WEB_SOURCE + '}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.199}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.199.tar.gz}'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.200}'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.200.tar.gz}'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING': (BUILD, 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-' + WEB_SHA + '}'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING': (BUILD, 'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-' + WEB_LOCK_SHA + '}'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING': (BUILD, 'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-' + WEB_SBOM_SHA + '}'),
-    'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.558}'),
-    'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.558}'),
+    'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.559}'),
+    'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.559}'),
     'SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING': (BUILD, 'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"'),
     'SERVER_WEB_CONSOLE_RUNTIME_VERSION_GATE_MISSING': (BUILD, 'test "$(cat "${web_root}/VERSION.txt")" = "${WEB_CONSOLE_RELEASE_TAG}"'),
     'SERVER_VOLUME_NATIVE_READ_ONLY_BUILD_GATE_MISSING': (DOCKER, 'grep -F \'"volume.isNative" : "r"\' >/dev/null'),
@@ -103,18 +103,18 @@
 CREATE_RESPONSE_CODES = ['SERVER_WEB_CREATE_IDENTITY_BUILD_GATE_MISSING','SERVER_WEB_CANONICAL_RECORD_BUILD_GATE_MISSING','SERVER_WEB_CREATE_IDENTITY_RUNTIME_GATE_MISSING','SERVER_WEB_CANONICAL_RECORD_RUNTIME_GATE_MISSING']
 ENGINE_EXPECTED = {
     'SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING': (DOCKER, 'release_engine_marker', (
-        'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.358',
+        'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.359',
         'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar',
         'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=' + ENGINE_SHA,
         'ARG ORCHESTRATION_ENGINE_COMMIT=' + ENGINE_SOURCE,
-        'ARG ORCHESTRATION_ENGINE_VERSION=0.183.358',
+        'ARG ORCHESTRATION_ENGINE_VERSION=0.183.359',
         'sh /usr/share/cattle/verify-engine-archive.sh "${archive}" "${ORCHESTRATION_ENGINE_VERSION}" "${ORCHESTRATION_ENGINE_ARTIFACT_SHA256}"',
         'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar',
         'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar',
         'ENV CATTLE_CATTLE_VERSION=${ORCHESTRATION_ENGINE_RELEASE_TAG}',
     )),
     'SERVER_INCREMENTAL_ENGINE_BUILD_COORDINATE_MISSING': (BUILD, 'release_engine_build_marker', (
-        'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.358}',
+        'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.359}',
         'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}',
         'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-' + ENGINE_SHA + '}',
         'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-' + ENGINE_SOURCE + '}',
@@ -154,8 +154,8 @@
             "ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628",
             "ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866",
             "ARG USAGE_TELEMETRY_AGENT_BINARY_SHA256=90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be",
-            "ARG COMPOSE_EXECUTOR_COMMIT=53a33bdc13ae99f4bc4a2dc5cc760b6b2d098388",
-            "ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=4ab4685af67a8b8b11f3dd4996de9e087c26391ec401cf02cdcafe4c93094bab"
+            "ARG COMPOSE_EXECUTOR_COMMIT=1835f8db645a8488e327b1f6e750bfdf3d1fb84d",
+            "ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732"
         ]
     ],
     [
@@ -174,10 +174,10 @@
             "usage_telemetry_agent_commit=${USAGE_TELEMETRY_AGENT_COMMIT:-4ee641bc1273cf582a77609af71d00b72f17b628}",
             "usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866}",
             "usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be}",
-            "compose_executor_version=${COMPOSE_EXECUTOR_VERSION:-0.14.39}",
-            "compose_executor_commit=${COMPOSE_EXECUTOR_COMMIT:-53a33bdc13ae99f4bc4a2dc5cc760b6b2d098388}",
-            "compose_executor_archive_sha256=${COMPOSE_EXECUTOR_ARCHIVE_SHA256:-4ab4685af67a8b8b11f3dd4996de9e087c26391ec401cf02cdcafe4c93094bab}",
-            "compose_executor_binary_sha256=${COMPOSE_EXECUTOR_BINARY_SHA256:-0f0c0ada23564572b569e1c73951ca363c0dc262fe7bba9c2474106650c4eac5}"
+            "compose_executor_version=${COMPOSE_EXECUTOR_VERSION:-0.14.40}",
+            "compose_executor_commit=${COMPOSE_EXECUTOR_COMMIT:-1835f8db645a8488e327b1f6e750bfdf3d1fb84d}",
+            "compose_executor_archive_sha256=${COMPOSE_EXECUTOR_ARCHIVE_SHA256:-fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732}",
+            "compose_executor_binary_sha256=${COMPOSE_EXECUTOR_BINARY_SHA256:-a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc}"
         ]
     ],
     [
@@ -608,15 +608,15 @@ def verify(files, gate=GATE):
                 pipeline = r'(?:^|[;\n])\s*' + re.escape(marker) + r'(?=\s*(?:;|\n|$))'
                 if len(re.findall(pipeline, source)) != 1:
                     raise AssertionError('CURRENT_CATALOG_HASH_BYPASS')
-    if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.558"' not in gate:
+    if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.559"' not in gate:
         raise AssertionError('CURRENT_VEX_GATE_PIN_MISMATCH')
-    if '"$vendor_pending_fixture" v1.6.558 >/dev/null' not in gate:
+    if '"$vendor_pending_fixture" v1.6.559 >/dev/null' not in gate:
         raise AssertionError('CURRENT_VENDOR_GATE_PIN_MISMATCH')
-    if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.558':
+    if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.559':
         raise AssertionError('CURRENT_VEX_RELEASE_MISMATCH')
-    if json.loads(files[VENDOR]).get('release') != 'v1.6.558':
+    if json.loads(files[VENDOR]).get('release') != 'v1.6.559':
         raise AssertionError('CURRENT_VENDOR_RELEASE_MISMATCH')
-    if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.558 base=v1.6.460 engine=0.183.358 web_console=1.6.199 catalog_service=0.20.15 ' not in gate:
+    if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.559 base=v1.6.460 engine=0.183.359 web_console=1.6.200 catalog_service=0.20.17 ' not in gate:
         raise AssertionError('CURRENT_SUMMARY_MISMATCH')
     verify_incremental_contract(files, gate)
     verify_load_balancer_contract(files, gate)
@@ -631,11 +631,11 @@ def previous_gate(gate=GATE):
         if stale(marker) != marker:
             replacements["'" + marker + "' "] = "'" + stale(marker) + "' "
     replacements.update({
-        'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.558"':
+        'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.559"':
             'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.521"',
-        '"$vendor_pending_fixture" v1.6.558 >/dev/null':
+        '"$vendor_pending_fixture" v1.6.559 >/dev/null':
             '"$vendor_pending_fixture" v1.6.521 >/dev/null',
-        'SERVER_API_EXPLORER_PATCH_OK release=v1.6.558 base=v1.6.460 engine=0.183.358 web_console=1.6.199 catalog_service=0.20.15 ':
+        'SERVER_API_EXPLORER_PATCH_OK release=v1.6.559 base=v1.6.460 engine=0.183.359 web_console=1.6.200 catalog_service=0.20.17 ':
             'SERVER_API_EXPLORER_PATCH_OK release=v1.6.521 base=v1.6.460 engine=0.183.340 web_console=1.6.181 catalog_service=0.20.12 ',
     })
     for marker, stale_marker in replacements.items():
@@ -841,10 +841,10 @@ def test_other_formal_component_coordinates_and_stale_inputs_fail_closed(self):
     [
         "COMPOSE_EXECUTOR",
         "compose_executor",
-        "0.14.39",
-        "53a33bdc13ae99f4bc4a2dc5cc760b6b2d098388",
-        "4ab4685af67a8b8b11f3dd4996de9e087c26391ec401cf02cdcafe4c93094bab",
-        "0f0c0ada23564572b569e1c73951ca363c0dc262fe7bba9c2474106650c4eac5"
+        "0.14.40",
+        "1835f8db645a8488e327b1f6e750bfdf3d1fb84d",
+        "fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732",
+        "a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc"
     ],
     [
         "VSPHERE_CLI_BUNDLE",
@@ -1299,7 +1299,7 @@ def test_each_old_engine_coordinate_rejected(self):
         self.assertGreater(checked, 0)
 
     def test_historical_engine340_cannot_be_packaged(self):
-        old = {'0.183.358': '0.183.340',
+        old = {'0.183.359': '0.183.340',
                ENGINE_SHA: '5e5a1b908b43bf3824fc3bb2108bd661cd5199ce9bcfd187e0b18b5608a38cea',
                ENGINE_SOURCE: 'ff0a41e7676211043eb4f755a306a9e2a19abee1'}
         checked = 0
@@ -1320,13 +1320,13 @@ def test_historical_engine340_cannot_be_packaged(self):
 
     def test_engine352_actual_war_producer_and_previous351_350_boundary(self):
         candidate = (REPO / 'server/build-component-candidate.sh').read_text(encoding='utf-8')
-        self.assertIn('export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.558}', candidate)
-        self.assertIn('export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.358}', candidate)
+        self.assertIn('export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.559}', candidate)
+        self.assertIn('export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.359}', candidate)
         for old in (
-            {'0.183.358': '0.183.351',
+            {'0.183.359': '0.183.351',
              ENGINE_SHA: 'efd0e826364c551f782b281f081d53cadb48faa7d5c37c2f101e6f9c7d7f9ea6',
              ENGINE_SOURCE: '1befd83278618f9a5b7cdaf96522004dd89918ba'},
-            {'0.183.358': '0.183.350',
+            {'0.183.359': '0.183.350',
              ENGINE_SHA: '637ddaa42cd93c019b4d0813d7053b71dc42797a7f3ac2aa4b10fcc7e304cb31',
              ENGINE_SOURCE: '9c884710e5ea3d4136d80a870d9de9485674f3c3'},
             {ENGINE_SOURCE: '109f2623f00ca3a3a9079414a0f0f8bd23cd1eb2'},
@@ -1349,7 +1349,7 @@ def test_engine352_actual_war_producer_and_previous351_350_boundary(self):
 
 
     def test_immediately_previous_engine341_cannot_be_packaged(self):
-        old = {'0.183.358': '0.183.341',
+        old = {'0.183.359': '0.183.341',
                ENGINE_SHA: '3ede1ad28b7a7e0754c4c953bd486162f7ffe0b2f76ce384ec485632af6b8e6d',
                ENGINE_SOURCE: 'b245cf778479445ded0786d3898b03fea153212e'}
         checked = 0
@@ -1370,7 +1370,7 @@ def test_immediately_previous_engine341_cannot_be_packaged(self):
 
 
     def test_immediately_previous_engine342_cannot_be_packaged(self):
-        old = {'0.183.358': '0.183.342',
+        old = {'0.183.359': '0.183.342',
                ENGINE_SHA: '3533f247392795329c92516a7966510aafbe81a52e3f922e5ec657a2071363b5',
                ENGINE_SOURCE: 'ddae4bb8e12806f70816f5782cd999eccd0f2ce6'}
         checked = 0
@@ -1391,7 +1391,7 @@ def test_immediately_previous_engine342_cannot_be_packaged(self):
 
 
     def test_immediately_previous_engine343_cannot_be_packaged(self):
-        old = {'0.183.358': '0.183.343',
+        old = {'0.183.359': '0.183.343',
                ENGINE_SHA: 'b29c0057f96dbae38bfe2c663c63bbe4c8b5c755b3090f39414aa51f9813025f',
                ENGINE_SOURCE: '5aa9d8978c75a7fe63330453c399a92716d88568'}
         checked = 0
@@ -1412,7 +1412,7 @@ def test_immediately_previous_engine343_cannot_be_packaged(self):
 
 
     def test_immediately_previous_engine344_cannot_be_packaged(self):
-        old = {'0.183.358': '0.183.344',
+        old = {'0.183.359': '0.183.344',
                ENGINE_SHA: 'ffafa4700156b74ec11bcae1b830738e49943f1a3b8b0565895ed6d7726eebf1',
                ENGINE_SOURCE: '72c42e6f2000301fe03ffd2442fb9ee89aee120c'}
         checked = 0
@@ -1432,7 +1432,7 @@ def test_immediately_previous_engine344_cannot_be_packaged(self):
         self.assertGreater(checked, 0)
 
     def test_immediately_previous_engine345_cannot_be_packaged(self):
-        old = {'0.183.358': '0.183.345',
+        old = {'0.183.359': '0.183.345',
                ENGINE_SHA: '780263c4a884527fa80a28b998ad4bda88b9ad6002a687f9f074602ecad46e62',
                ENGINE_SOURCE: 'd27d4ac73fa05ae43b9ae0c32875780e8a3765b1'}
         checked = 0
@@ -1452,7 +1452,7 @@ def test_immediately_previous_engine345_cannot_be_packaged(self):
         self.assertGreater(checked, 0)
 
     def test_immediately_previous_engine346_cannot_be_packaged(self):
-        old = {'0.183.358': '0.183.346',
+        old = {'0.183.359': '0.183.346',
                ENGINE_SHA: '9deeda5758b7f04135441a203092dd0308d90b65d25037b62ef4f9361d3cf806',
                ENGINE_SOURCE: 'e250e4a17958216c30c1f5d0d31f7b6418a968d5'}
         checked = 0
@@ -1628,7 +1628,7 @@ def test_machine_actual_binary_package_and_retired_boundary_are_verified(self):
     def test_current_readme_status_specific_prose_does_not_block_publication_transition(self):
         common = GATE.split('for current_readme_marker in ', 1)[1].split('; do', 1)[0]
         self.assertNotIn('candidate', common)
-        self.assertNotIn('v1.6.558', common)
+        self.assertNotIn('v1.6.559', common)
         self.assertIn("grep -Fqi 'keep all three named volumes' README.md", GATE)
         status = GATE.split("if grep -Fxq '## Current source candidate' README.md; then", 1)[1]
         candidate, published = status.split("elif grep -Fxq '## Current release' README.md; then", 1)
@@ -1637,7 +1637,7 @@ def test_current_readme_status_specific_prose_does_not_block_publication_transit
         self.assertIn('This candidate is not yet available', candidate)
         self.assertIn('SERVER_CURRENT_PUBLISHED_README_MISSING', published)
         self.assertNotIn('candidate', published)
-        self.assertNotIn('v1.6.558', published)
+        self.assertNotIn('v1.6.559', published)
 
 
 if __name__ == '__main__':
diff --git a/server/Dockerfile.web-compose-release b/server/Dockerfile.web-compose-release
index 920800c500..75f3b13137 100644
--- a/server/Dockerfile.web-compose-release
+++ b/server/Dockerfile.web-compose-release
@@ -90,19 +90,19 @@ ARG PER_HOST_SUBNET_STARTUP_SHA256=f22b41f18d1733c037babed4d2e0474efeedc6017a968
 ARG PER_HOST_SUBNET_PROVENANCE_SHA256=afa2db0e0755c6bd3ee28e111937c521a6d84e6d71d563e99202cf4693000eaf
 
 ARG WEB_CONSOLE_RELEASE_BASE_URL=https://github.com/PastureStack/web-console/releases/download
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.199
-ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.199.tar.gz
-ARG WEB_CONSOLE_ARTIFACT_SHA256=ab60d4baa10685021b74db09b805dee1f866e9bd0fbccea4d54610df907c7570
-ARG WEB_CONSOLE_COMMIT=80a47df65f6406087b80aa81cfa99fe1f438ecff
-ARG WEB_CONSOLE_LOCK_SHA256=e9f88f608cd4d516a69141464a6eb853ec1179bb86415979fad0569cdfa88173
-ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.199-runtime.cdx.json
-ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=324948a11348729a334864c04850a77b2e5c4643546168ee7b8c7289e983ac31
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.200
+ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.200.tar.gz
+ARG WEB_CONSOLE_ARTIFACT_SHA256=97fe46c426cb83263fcfc7f5884c15ca90f7ec3ebec71d9ca023d8b7ad2665c0
+ARG WEB_CONSOLE_COMMIT=03e0d7b25b8dfcbc45baecf6d448834016aac649
+ARG WEB_CONSOLE_LOCK_SHA256=1797dd27bb7b1c6b86b8689435e916b03523a9fdf45c5178ec7c2ea05706d4bd
+ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.200-runtime.cdx.json
+ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=0ce1f6b99e1e449c545d3d7df65302fdb58d1974fecea6477b20262c2148921c
 ARG CATALOG_SERVICE_RELEASE_BASE_URL=https://github.com/PastureStack/catalog-service/releases/download
-ARG CATALOG_SERVICE_VERSION=0.20.15
-ARG CATALOG_SERVICE_COMMIT=6ea547594065f7f95d5877b82f0c1bc553e72640
-ARG CATALOG_SERVICE_ARCHIVE_SHA256=7c059101265d897e4b176f503a9217b112946d37d91daa0c40f421fb16e4bb6b
-ARG CATALOG_SERVICE_BINARY_SHA256=948a528987113a2d37f5ee519c4f682e09af4aa10ff64d490d9851ba7b633364
-ARG CATALOG_SERVICE_SQLITE_BINARY_SHA256=b890cfc7941ad3ba1bde4038c0acde4098fa101512553159d4615e540f8bb659
+ARG CATALOG_SERVICE_VERSION=0.20.17
+ARG CATALOG_SERVICE_COMMIT=2f70559e340865eb6243662ed33d8cbc7b1efa90
+ARG CATALOG_SERVICE_ARCHIVE_SHA256=4f83f89763ce325262baf8984782da2c21fd81e3cc22c0a1c76aaa50b2a50f20
+ARG CATALOG_SERVICE_BINARY_SHA256=f2a63056d5d48e032bdfd0dbcbe1b2254f6353f1a76125f86a72a31ec532da45
+ARG CATALOG_SERVICE_SQLITE_BINARY_SHA256=94bd4729bd129c333435ab98963080f44d08bec00f814442c99c390ec97b46ce
 ARG CATALOG_SERVICE_LICENSE_SHA256=0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
 ARG AUTHENTICATION_SERVICE_RELEASE_BASE_URL=https://github.com/PastureStack/authentication-service/releases/download
 ARG AUTHENTICATION_SERVICE_VERSION=0.4.46
@@ -118,13 +118,13 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.5
 ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=f2df8874d5a00a2d5713594609063256164ed624d29a733149d00cb271f0f66b
 ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=b98e55db2739ab45119eacc94c8f65cb44371480ebcebec95e5470fd67c72a4c
 ARG ORCHESTRATION_ENGINE_RELEASE_BASE_URL=https://github.com/PastureStack/orchestration-engine/releases/download
-ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.358
+ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.359
 ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar
-ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=46ad548c6e284a7758eb7f65c85fb5878e2ebdc861ef5c396a00a6510709b733
+ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=07e7de2548bd98d5209bf3594d69fe5b9a5d7ddba36eed4b6b6e4406022c3f90
 ARG COMPOSE_EXECUTOR_RELEASE_BASE_URL=https://github.com/PastureStack/compose-cli/releases/download
-ARG COMPOSE_EXECUTOR_VERSION=0.14.39
-ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=4ab4685af67a8b8b11f3dd4996de9e087c26391ec401cf02cdcafe4c93094bab
-ARG COMPOSE_EXECUTOR_BINARY_SHA256=0f0c0ada23564572b569e1c73951ca363c0dc262fe7bba9c2474106650c4eac5
+ARG COMPOSE_EXECUTOR_VERSION=0.14.40
+ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732
+ARG COMPOSE_EXECUTOR_BINARY_SHA256=a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc
 ARG VSPHERE_CLI_BUNDLE_RELEASE_BASE_URL=https://github.com/PastureStack/vsphere-cli-bundle/releases/download
 ARG VSPHERE_CLI_BUNDLE_VERSION=0.55.4
 ARG VSPHERE_CLI_BUNDLE_ARCHIVE_SHA256=abec8c22504adde66e2ccd89b7b764c8a643c5e1e4425dafb2964abde75806a0
@@ -696,12 +696,12 @@ ARG PER_HOST_SUBNET_VERSION=0.2.5
 ARG PER_HOST_SUBNET_PRODUCER_COMMIT=e102e0bb38d84b0a9cbf87e5458cf1bc74d01904
 ARG PER_HOST_SUBNET_ARCHIVE_SHA256=7237e83e96a64e7f3de64eb86bff9721c4e879c35cda9e9de1e4cb1ba225f298
 ARG PER_HOST_SUBNET_PROVENANCE_SHA256=afa2db0e0755c6bd3ee28e111937c521a6d84e6d71d563e99202cf4693000eaf
-ARG SERVER_RELEASE_TAG=v1.6.558
+ARG SERVER_RELEASE_TAG=v1.6.559
 ARG API_EXPLORER_RELEASE_TAG=v1.1.20
 ARG API_EXPLORER_ARTIFACT_SHA256=c989ee12a518f6d9d2b23b1f17f48d781aacf6ec31fb65291dd7de9b1661badb
 ARG API_EXPLORER_COMMIT=a586f0dc0aa50df579049a8d4bf26f04400fdf75
-ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.358
-ARG ORCHESTRATION_ENGINE_VERSION=0.183.358
+ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.359
+ARG ORCHESTRATION_ENGINE_VERSION=0.183.359
 ARG ENGINE_READONLY_SCHEMA_SHA256=7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233
 ARG ENGINE_RESTRICTED_SCHEMA_SHA256=f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51
 ARG HOST_API_VERSION=0.38.8
@@ -722,16 +722,16 @@ ARG GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4
 ARG GLIBC_RUNTIME_PACKAGE_VERSION=2.43-2ubuntu2.4+pasturestack.1
 ARG PERL_PACKAGE_VERSION=5.40.1-7ubuntu0.3
 ARG PCRE2_PACKAGE_VERSION=10.46-1build1+pasturestack.1
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.199
-ARG WEB_CONSOLE_ARTIFACT_SHA256=ab60d4baa10685021b74db09b805dee1f866e9bd0fbccea4d54610df907c7570
-ARG WEB_CONSOLE_COMMIT=80a47df65f6406087b80aa81cfa99fe1f438ecff
-ARG WEB_CONSOLE_LOCK_SHA256=e9f88f608cd4d516a69141464a6eb853ec1179bb86415979fad0569cdfa88173
-ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=324948a11348729a334864c04850a77b2e5c4643546168ee7b8c7289e983ac31
-ARG CATALOG_SERVICE_VERSION=0.20.15
-ARG CATALOG_SERVICE_COMMIT=6ea547594065f7f95d5877b82f0c1bc553e72640
-ARG CATALOG_SERVICE_ARCHIVE_SHA256=7c059101265d897e4b176f503a9217b112946d37d91daa0c40f421fb16e4bb6b
-ARG CATALOG_SERVICE_BINARY_SHA256=948a528987113a2d37f5ee519c4f682e09af4aa10ff64d490d9851ba7b633364
-ARG CATALOG_SERVICE_SQLITE_BINARY_SHA256=b890cfc7941ad3ba1bde4038c0acde4098fa101512553159d4615e540f8bb659
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.200
+ARG WEB_CONSOLE_ARTIFACT_SHA256=97fe46c426cb83263fcfc7f5884c15ca90f7ec3ebec71d9ca023d8b7ad2665c0
+ARG WEB_CONSOLE_COMMIT=03e0d7b25b8dfcbc45baecf6d448834016aac649
+ARG WEB_CONSOLE_LOCK_SHA256=1797dd27bb7b1c6b86b8689435e916b03523a9fdf45c5178ec7c2ea05706d4bd
+ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=0ce1f6b99e1e449c545d3d7df65302fdb58d1974fecea6477b20262c2148921c
+ARG CATALOG_SERVICE_VERSION=0.20.17
+ARG CATALOG_SERVICE_COMMIT=2f70559e340865eb6243662ed33d8cbc7b1efa90
+ARG CATALOG_SERVICE_ARCHIVE_SHA256=4f83f89763ce325262baf8984782da2c21fd81e3cc22c0a1c76aaa50b2a50f20
+ARG CATALOG_SERVICE_BINARY_SHA256=f2a63056d5d48e032bdfd0dbcbe1b2254f6353f1a76125f86a72a31ec532da45
+ARG CATALOG_SERVICE_SQLITE_BINARY_SHA256=94bd4729bd129c333435ab98963080f44d08bec00f814442c99c390ec97b46ce
 ARG CATALOG_SERVICE_LICENSE_SHA256=0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
 ARG AUTHENTICATION_SERVICE_VERSION=0.4.46
 ARG AUTHENTICATION_SERVICE_COMMIT=35333ee3e40d9de032c10307ee80113c980be00a
@@ -745,8 +745,8 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.5
 ARG WEBHOOK_AUTOMATION_SERVICE_COMMIT=4da77ccac464bc7f7cd2020e0659a666a5d1ff7e
 ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=f2df8874d5a00a2d5713594609063256164ed624d29a733149d00cb271f0f66b
 ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=b98e55db2739ab45119eacc94c8f65cb44371480ebcebec95e5470fd67c72a4c
-ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=46ad548c6e284a7758eb7f65c85fb5878e2ebdc861ef5c396a00a6510709b733
-ARG ORCHESTRATION_ENGINE_COMMIT=1da1f4c37fe43b8c387045c263d286f7db01c574
+ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=07e7de2548bd98d5209bf3594d69fe5b9a5d7ddba36eed4b6b6e4406022c3f90
+ARG ORCHESTRATION_ENGINE_COMMIT=eac3fde5fc7779b6107e2702785120a9c591927b
 ARG HOST_PROVISIONER_VERSION=0.39.10
 ARG HOST_PROVISIONER_COMMIT=d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba
 ARG HOST_PROVISIONER_ARCHIVE_SHA256=fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661
@@ -759,10 +759,10 @@ ARG USAGE_TELEMETRY_AGENT_VERSION=0.4.4
 ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628
 ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866
 ARG USAGE_TELEMETRY_AGENT_BINARY_SHA256=90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be
-ARG COMPOSE_EXECUTOR_VERSION=0.14.39
-ARG COMPOSE_EXECUTOR_COMMIT=53a33bdc13ae99f4bc4a2dc5cc760b6b2d098388
-ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=4ab4685af67a8b8b11f3dd4996de9e087c26391ec401cf02cdcafe4c93094bab
-ARG COMPOSE_EXECUTOR_BINARY_SHA256=0f0c0ada23564572b569e1c73951ca363c0dc262fe7bba9c2474106650c4eac5
+ARG COMPOSE_EXECUTOR_VERSION=0.14.40
+ARG COMPOSE_EXECUTOR_COMMIT=1835f8db645a8488e327b1f6e750bfdf3d1fb84d
+ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732
+ARG COMPOSE_EXECUTOR_BINARY_SHA256=a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc
 ARG VSPHERE_CLI_BUNDLE_VERSION=0.55.4
 ARG VSPHERE_CLI_BUNDLE_COMMIT=35ca999b775a41e7fb34e9a6b6ceb4fa51f3f242
 ARG VSPHERE_CLI_BUNDLE_ARCHIVE_SHA256=abec8c22504adde66e2ccd89b7b764c8a643c5e1e4425dafb2964abde75806a0
diff --git a/server/build-api-explorer-patch-image.sh b/server/build-api-explorer-patch-image.sh
index 3ccfcedd27..f8b7dfeb9d 100755
--- a/server/build-api-explorer-patch-image.sh
+++ b/server/build-api-explorer-patch-image.sh
@@ -14,14 +14,14 @@ if [[ -n "$(git status --porcelain --untracked-files=normal)" ]]; then
 fi
 
 revision=${PASTURESTACK_SERVER_REVISION:-$(git rev-parse HEAD)}
-server_release_tag=${SERVER_RELEASE_TAG:-v1.6.558}
+server_release_tag=${SERVER_RELEASE_TAG:-v1.6.559}
 source_date_epoch=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)}
 base_image=${BASE_IMAGE:-ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403}
 orchestration_engine_release_base_url=${ORCHESTRATION_ENGINE_RELEASE_BASE_URL:-https://github.com/PastureStack/orchestration-engine/releases/download}
-orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.358}
+orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.359}
 orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}
-orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-46ad548c6e284a7758eb7f65c85fb5878e2ebdc861ef5c396a00a6510709b733}
-orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-1da1f4c37fe43b8c387045c263d286f7db01c574}
+orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-07e7de2548bd98d5209bf3594d69fe5b9a5d7ddba36eed4b6b6e4406022c3f90}
+orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-eac3fde5fc7779b6107e2702785120a9c591927b}
 orchestration_engine_version=${orchestration_engine_release_tag#v}
 engine_readonly_schema_sha256=${ENGINE_READONLY_SCHEMA_SHA256:-7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233}
 engine_restricted_schema_sha256=${ENGINE_RESTRICTED_SCHEMA_SHA256:-f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51}
@@ -63,19 +63,19 @@ api_explorer_artifact=${API_EXPLORER_ARTIFACT:-api-explorer-1.1.20.tar.gz}
 api_explorer_artifact_sha256=${API_EXPLORER_ARTIFACT_SHA256:-c989ee12a518f6d9d2b23b1f17f48d781aacf6ec31fb65291dd7de9b1661badb}
 api_explorer_commit=${API_EXPLORER_COMMIT:-a586f0dc0aa50df579049a8d4bf26f04400fdf75}
 web_console_release_base_url=${WEB_CONSOLE_RELEASE_BASE_URL:-https://github.com/PastureStack/web-console/releases/download}
-web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.199}
-web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.199.tar.gz}
-web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-ab60d4baa10685021b74db09b805dee1f866e9bd0fbccea4d54610df907c7570}
-web_console_commit=${WEB_CONSOLE_COMMIT:-80a47df65f6406087b80aa81cfa99fe1f438ecff}
-web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-e9f88f608cd4d516a69141464a6eb853ec1179bb86415979fad0569cdfa88173}
+web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.200}
+web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.200.tar.gz}
+web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-97fe46c426cb83263fcfc7f5884c15ca90f7ec3ebec71d9ca023d8b7ad2665c0}
+web_console_commit=${WEB_CONSOLE_COMMIT:-03e0d7b25b8dfcbc45baecf6d448834016aac649}
+web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-1797dd27bb7b1c6b86b8689435e916b03523a9fdf45c5178ec7c2ea05706d4bd}
 web_console_runtime_sbom_artifact=${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT:-web-console-${web_console_release_tag}-runtime.cdx.json}
-web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-324948a11348729a334864c04850a77b2e5c4643546168ee7b8c7289e983ac31}
+web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-0ce1f6b99e1e449c545d3d7df65302fdb58d1974fecea6477b20262c2148921c}
 catalog_service_release_base_url=${CATALOG_SERVICE_RELEASE_BASE_URL:-https://github.com/PastureStack/catalog-service/releases/download}
-catalog_service_version=${CATALOG_SERVICE_VERSION:-0.20.15}
-catalog_service_commit=${CATALOG_SERVICE_COMMIT:-6ea547594065f7f95d5877b82f0c1bc553e72640}
-catalog_service_archive_sha256=${CATALOG_SERVICE_ARCHIVE_SHA256:-7c059101265d897e4b176f503a9217b112946d37d91daa0c40f421fb16e4bb6b}
-catalog_service_binary_sha256=${CATALOG_SERVICE_BINARY_SHA256:-948a528987113a2d37f5ee519c4f682e09af4aa10ff64d490d9851ba7b633364}
-catalog_service_sqlite_binary_sha256=${CATALOG_SERVICE_SQLITE_BINARY_SHA256:-b890cfc7941ad3ba1bde4038c0acde4098fa101512553159d4615e540f8bb659}
+catalog_service_version=${CATALOG_SERVICE_VERSION:-0.20.17}
+catalog_service_commit=${CATALOG_SERVICE_COMMIT:-2f70559e340865eb6243662ed33d8cbc7b1efa90}
+catalog_service_archive_sha256=${CATALOG_SERVICE_ARCHIVE_SHA256:-4f83f89763ce325262baf8984782da2c21fd81e3cc22c0a1c76aaa50b2a50f20}
+catalog_service_binary_sha256=${CATALOG_SERVICE_BINARY_SHA256:-f2a63056d5d48e032bdfd0dbcbe1b2254f6353f1a76125f86a72a31ec532da45}
+catalog_service_sqlite_binary_sha256=${CATALOG_SERVICE_SQLITE_BINARY_SHA256:-94bd4729bd129c333435ab98963080f44d08bec00f814442c99c390ec97b46ce}
 catalog_service_license_sha256=${CATALOG_SERVICE_LICENSE_SHA256:-0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594}
 authentication_service_release_base_url=${AUTHENTICATION_SERVICE_RELEASE_BASE_URL:-https://github.com/PastureStack/authentication-service/releases/download}
 authentication_service_version=${AUTHENTICATION_SERVICE_VERSION:-0.4.46}
@@ -93,10 +93,10 @@ webhook_automation_service_commit=${WEBHOOK_AUTOMATION_SERVICE_COMMIT:-4da77ccac
 webhook_automation_service_archive_sha256=${WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256:-f2df8874d5a00a2d5713594609063256164ed624d29a733149d00cb271f0f66b}
 webhook_automation_service_binary_sha256=${WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256:-b98e55db2739ab45119eacc94c8f65cb44371480ebcebec95e5470fd67c72a4c}
 compose_executor_release_base_url=${COMPOSE_EXECUTOR_RELEASE_BASE_URL:-https://github.com/PastureStack/compose-cli/releases/download}
-compose_executor_version=${COMPOSE_EXECUTOR_VERSION:-0.14.39}
-compose_executor_commit=${COMPOSE_EXECUTOR_COMMIT:-53a33bdc13ae99f4bc4a2dc5cc760b6b2d098388}
-compose_executor_archive_sha256=${COMPOSE_EXECUTOR_ARCHIVE_SHA256:-4ab4685af67a8b8b11f3dd4996de9e087c26391ec401cf02cdcafe4c93094bab}
-compose_executor_binary_sha256=${COMPOSE_EXECUTOR_BINARY_SHA256:-0f0c0ada23564572b569e1c73951ca363c0dc262fe7bba9c2474106650c4eac5}
+compose_executor_version=${COMPOSE_EXECUTOR_VERSION:-0.14.40}
+compose_executor_commit=${COMPOSE_EXECUTOR_COMMIT:-1835f8db645a8488e327b1f6e750bfdf3d1fb84d}
+compose_executor_archive_sha256=${COMPOSE_EXECUTOR_ARCHIVE_SHA256:-fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732}
+compose_executor_binary_sha256=${COMPOSE_EXECUTOR_BINARY_SHA256:-a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc}
 vsphere_cli_bundle_release_base_url=${VSPHERE_CLI_BUNDLE_RELEASE_BASE_URL:-https://github.com/PastureStack/vsphere-cli-bundle/releases/download}
 machine_driver_bundle_release_base_url=${MACHINE_DRIVER_BUNDLE_RELEASE_BASE_URL:-https://github.com/PastureStack/machine-driver-bundle/releases/download}
 machine_driver_bundle_version=${MACHINE_DRIVER_BUNDLE_VERSION:-0.16.6}
@@ -130,7 +130,7 @@ usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d4
 usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be}
 supported_docker_range='~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0'
 newest_docker_version=v29.8.0
-image=${IMAGE:-pasturestack-validation/server:v1.6.558}
+image=${IMAGE:-pasturestack-validation/server:v1.6.559}
 build_options=()
 
 [[ "$revision" =~ ^[0-9a-f]{40}$ ]]
@@ -873,7 +873,7 @@ docker run --rm --env "ORCHESTRATION_ENGINE_VERSION=${orchestration_engine_versi
     done
     cat <<'"'"'EOF'"'"' | sha256sum -c -
 e121cee8b7a6bd3c0eb6fe3e15ff304b78119b426642ed76f13e3d92be161192  /usr/bin/authentication-service.real
-0f0c0ada23564572b569e1c73951ca363c0dc262fe7bba9c2474106650c4eac5  /usr/bin/compose-executor.real
+a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc  /usr/bin/compose-executor.real
 92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff  /usr/bin/host-provisioner.real
 1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c  /usr/bin/secret-delivery-api
 90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be  /usr/bin/usage-telemetry-agent
diff --git a/server/build-component-candidate.sh b/server/build-component-candidate.sh
index ddf85658ed..609f482195 100755
--- a/server/build-component-candidate.sh
+++ b/server/build-component-candidate.sh
@@ -18,10 +18,10 @@ for name in "${required[@]}"; do
     case "$name" in *_COMMIT) [[ ${!name} =~ ^[0-9a-f]{40}$ ]] ;; *) [[ ${!name} =~ ^[0-9a-f]{64}$ ]] ;; esac
     export "$name"
 done
-export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.558}
-export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.358}
+export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.559}
+export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.359}
 export ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar
-export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.199}
+export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.200}
 export WEB_CONSOLE_ARTIFACT="web-console-${WEB_CONSOLE_RELEASE_TAG}.tar.gz"
 export WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT:-web-console-${WEB_CONSOLE_RELEASE_TAG}-runtime.cdx.json}
 export WEBSOCKET_PROXY_VERSION=${WEBSOCKET_PROXY_VERSION:-0.23.18}
diff --git a/server/security/openvex.json b/server/security/openvex.json
index 9462c712b7..5b35013be3 100644
--- a/server/security/openvex.json
+++ b/server/security/openvex.json
@@ -1,9 +1,9 @@
 {
   "@context": "https://openvex.dev/ns/v0.2.0",
-  "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.558",
+  "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.559",
   "author": "PastureStack Security",
-  "timestamp": "2026-10-29T19:33:54Z",
-  "version": 70,
+  "timestamp": "2026-10-29T22:47:40Z",
+  "version": 71,
   "statements": [
     {
       "vulnerability": {
diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json
index 6976d8cce7..3c5d6e368c 100644
--- a/server/security/vendor-pending.json
+++ b/server/security/vendor-pending.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "release": "v1.6.558",
+  "release": "v1.6.559",
   "generatedAt": "2026-10-29T09:57:33.809116+00:00",
   "policy": {
     "allowedSeverities": [