docs: align published Server528 installation and scoped acceptance

COMPATIBILITY.md

@@ -1,24 +1,28 @@
 # Compatibility Contract
 
-## Server v1.6.526 published
+## Server v1.6.528 published
 
-This release packages Engine `v0.183.344` and unchanged Web Console `1.6.183`.
+This release packages Engine `v0.183.346` and unchanged Web Console `1.6.183`.
 Operation-specific lookups allow an authorized named export or registered action
 to load its exact operand while ordinary GET/list, references, owner RBAC, scope,
 deny precedence and expiry retain their existing boundaries. Method dispatch and
 old queued-Key checks remain in force. Other components, role schemas,
 authentication, broker, registration, HA and runtime settings are unchanged.
+Container/Instance Link Stack ancestry uses total null-safe comparisons and a
+unique-PK scalar marker, avoiding MariaDB's unsupported row/IN optimization.
+No global optimizer setting is changed or read authority broadened.
 
-The immutable producer is `dd95830037925ad00ecb98021aa8c8f2de8feb04`.
+The immutable producer is `cbd0a988d0cd2882842f4f2a8012af3f841b479e`.
 The linux/amd64 image has one runtime layer. Its actual registry manifest is
-`ghcr.io/pasturestack/server:v1.6.526@sha256:2c724739d37d4bef2c5f1013f334f3109ef8279dcbe390ff0ed68e4e2ff18379`;
+`ghcr.io/pasturestack/server:v1.6.528@sha256:1d6bbc1081b5ead8cabcd3f72ff17bf3522d90d94ad97ed83add425a9880e42f`;
 the distinct OCI configuration digest is
-`sha256:e92382b15773dcb4335ef01c5bb9634d4716ee8eeefcc99c267f4f0875ca2944`.
-Original publication and immutable readback passed. Targeted native linked/action
-and read-boundary acceptance passed on both API roots. The isolated QA upgrade
-from published Server524 and one restart preserved runtime settings and all three
-volumes. Complete role/action/resource coverage remains separate.
-See the [release note](docs/releases/server-1.6.526.md) for the exact scope.
+`sha256:d420681bc58de55239ae212b7d929d37e9eca2beb484a44d48368f609054fa0c`.
+Original publication and immutable readback passed. Sixteen scoped Link/Container
+direct/list hit/miss reads on both API roots passed with 32 matched audit events,
+unchanged database snapshots and owned cleanup. The separate isolated QA upgrade
+from Server526 and one restart preserved runtime settings and all three volumes.
+Complete role/action/resource coverage remains separate.
+See the [release note](docs/releases/server-1.6.528.md) for the exact scope.
 
 ## Server v1.6.524 published
 

README.md

@@ -13,17 +13,19 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-Server [`v1.6.526`](https://github.com/PastureStack/server/releases/tag/v1.6.526)
-packages Web Console `1.6.183` and Orchestration Engine `v0.183.344`.
+Server [`v1.6.528`](https://github.com/PastureStack/server/releases/tag/v1.6.528)
+packages Web Console `1.6.183` and Orchestration Engine `v0.183.346`.
 API Key permissions follow the actual operation and the owner's live authority.
 Authorized compose exports and registered actions can load their exact target
 without granting ordinary read/list access or broader resource scope.
+Stack-scoped Container and Instance Link queries retain live ancestry checks
+and work with MariaDB's default optimizer, including nullable Stack references.
 
 Registration tokens use dedicated Basic authentication. Native project creation
 preserves the creator's initial membership and default networks. HA database
 exports return a SQL ZIP only after successful, nonempty output; failures clean
 up temporary files without returning command stderr or secrets.
-See the [release note](docs/releases/server-1.6.526.md) for component identities
+See the [release note](docs/releases/server-1.6.528.md) for component identities
 and acceptance limits.
 
 The console supports OIDC, TOTP and passkeys, role-aware resource operations,
@@ -66,15 +68,15 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.526
+  ghcr.io/pasturestack/server:v1.6.528
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.526
+    image: ghcr.io/pasturestack/server:v1.6.528
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/README.md

@@ -7,6 +7,11 @@ runtime gates have passed.
 
 ## Release notes
 
+- [Server v1.6.528](releases/server-1.6.528.md) — published with Engine
+  `0.183.346` and unchanged Web Console `1.6.183`; fixes MariaDB Stack-ancestry
+  queries without expanding authorization. Sixteen scoped native reads and a
+  separate isolated upgrade/restart passed; full matrix coverage remains separate.
+
 - [Server v1.6.526](releases/server-1.6.526.md) — published with Engine
   `0.183.344` and unchanged Web Console `1.6.183`; operation-specific linked/action
   lookups retain ordinary-read and owner-authority boundaries. Targeted native

docs/api-keys.md

@@ -1,6 +1,6 @@
 # API Keys
 
-This guide describes published Server `v1.6.526`, with Engine `0.183.344`
+This guide describes published Server `v1.6.528`, with Engine `0.183.346`
 and Web Console `1.6.183`. Publication does not mean that every role/resource
 combination has passed acceptance. Use the published numeric image tag in the
 [installation guide](../README.md#quick-start).
@@ -24,6 +24,12 @@ Resource loading needed by an authorized mutation, named export or registered
 action remains bound to the actual operation, exact target, Key policy and live
 owner authority. Ordinary reads, lists and input references keep their own checks.
 
+Container and native `instanceLink` reads derive scope from persisted live
+Project/Stack ancestry before collection pagination. Link scope follows its
+source Instance, not the destination; reading a Link does not grant an ordinary
+Instance read. Missing, foreign or contradictory ancestry fails closed. Nullable
+Stack comparisons and parent lookups work with MariaDB's default optimizer.
+
 The editor and reviewed changes show the same resource-by-operation policy
 matrix. It explains deny precedence, partial scopes, unresolved ancestry and
 expiry, with readable resource names. This is a Key-rule preview, not a guarantee

docs/performance/README.md

@@ -8,13 +8,13 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published `v1.6.526` image. See the
-[release note](../releases/server-1.6.526.md) for exact identities and acceptance limits.
+The example uses the published `v1.6.528` image. See the
+[release note](../releases/server-1.6.528.md) for exact identities and acceptance limits.
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.526
+    image: ghcr.io/pasturestack/server:v1.6.528
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/releases/server-1.6.528.md

@@ -15,11 +15,32 @@ Container／Link 共用的 Stack 比較明確處理雙 NULL 與單側 NULL，不
 - Engine 三項相關測試與 MariaDB 11.8.6 的兩個完整唯讀 SQL 查詢通過。
   這些是來源與資料庫相容性證據，不替代組裝映像的業務授權驗收。
 
-Server 仍須通過原有封裝、必要 CodeQL、merged-rootfs 安全／SBOM、
-不可變發行與實機檢查。只更新 VEX／待供應商修補清單的數字版本識別；
+Server 已通過原有封裝、必要 CodeQL、merged-rootfs 安全／SBOM、
+不可變發行與讀回檢查。只更新 VEX／待供應商修補清單的數字版本識別；
 既有決策、修補條件與期限不變。歷史 344 控制保留，另驗證舊 345
 來源與 WAR 不得冒充 346。KVM 與完整矩陣的未驗項目不宣稱通過。
 
+## 發行與實機結果
+
+不可變映像來源：`cbd0a988d0cd2882842f4f2a8012af3f841b479e`。
+[正式發行工作](https://github.com/PastureStack/server/actions/runs/38372165651)
+通過；linux/amd64 成品只有一個 runtime layer。
+Registry manifest：
+`ghcr.io/pasturestack/server:v1.6.528@sha256:1d6bbc1081b5ead8cabcd3f72ff17bf3522d90d94ad97ed83add425a9880e42f`。
+不同的 OCI config：
+`sha256:d420681bc58de55239ae212b7d929d37e9eca2beb484a44d48368f609054fa0c`。
+
+正式映像的 16 項唯讀驗收通過：Link 與 Container 各 8 項，涵蓋 v1／v2-beta、
+直接 ID／集合及 Stack 範圍命中／未命中。32 筆決策與回應稽核均可關聯，
+23 欄資料庫投影前後不變，測試容器與三個資料卷已清除。
+這是 owner 單一帳號的範圍驗收，不代表完整角色矩陣、資源寫入或生命週期。
+既有不受修改影響的通過項目沒有重跑。
+
+另一項隔離 QA 從 526 升至 528，啟動與一次重啟均回應 HTTP 200／pong，
+五類資料筆數不變，原環境變數、三個資料卷與 runtime 安全設定保留。
+已保留 526 容器與資料庫備份；沒有更新公司正式站。
+註冊入口檢查不等於完成新節點生命週期驗收。
+
 ## 升級與回復
 
 使用正式數字版本映像與原有 Compose，保留環境變數、named volumes、