diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
index 7361ed49c2..a98760c4bf 100644
--- a/COMPATIBILITY.md
+++ b/COMPATIBILITY.md
@@ -1,5 +1,20 @@
 # Compatibility Contract
 
+## Server v1.6.529 source candidate
+
+The candidate pairs Engine `v0.183.347` with Web Console `1.6.184`.
+Subscription terminal audit retains the first close/failure result, bounded
+delivery retry and exactly-once physical cleanup without restoring authorization.
+The console labels event subscriptions, including completion records without a
+target ID; this adds no resource-picker or grant capability. Full/legacy behavior,
+live restricted-Key checks, owner RBAC and audit bounds remain unchanged.
+
+Thirty focused Engine tests and three focused Web unit tests, including actual
+labels in all thirteen production locales, passed at the component level.
+Server publication, immutable image readback, native acceptance and deployment
+remain pending; the published installation pairing below remains `v1.6.528`.
+See the [candidate note](docs/releases/server-1.6.529.md) for exact input identities.
+
 ## Server v1.6.528 published
 
 This release packages Engine `v0.183.346` and unchanged Web Console `1.6.183`.
diff --git a/README.md b/README.md
index a453a908d0..19373db75a 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,12 @@ without granting ordinary read/list access or broader resource scope.
 Stack-scoped Container and Instance Link queries retain live ancestry checks
 and work with MariaDB's default optimizer, including nullable Stack references.
 
+The `v1.6.529` source candidate pairs Engine `v0.183.347` with Web Console
+`1.6.184` for subscription terminal audit and its translated target label.
+Component focused checks are separate from Server publication, native acceptance
+and deployment, which remain pending. See the [candidate note](docs/releases/server-1.6.529.md).
+Installation examples below remain on the published `v1.6.528` image.
+
 Registration tokens use dedicated Basic authentication. Native project creation
 preserves the creator's initial membership and default networks. HA database
 exports return a SQL ZIP only after successful, nonempty output; failures clean
diff --git a/docs/README.md b/docs/README.md
index 9eeff9414c..e0ab5fa644 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -7,6 +7,11 @@ runtime gates have passed.
 
 ## Release notes
 
+- [Server v1.6.529](releases/server-1.6.529.md) — source candidate with Engine
+  `0.183.347` and Web Console `1.6.184` for subscription terminal audit and its
+  translated target label. Server publication, native acceptance and deployment
+  remain pending; use the published `v1.6.528` installation guide below.
+
 - [Server v1.6.528](releases/server-1.6.528.md) — published with Engine
   `0.183.346` and unchanged Web Console `1.6.183`; fixes MariaDB Stack-ancestry
   queries without expanding authorization. Sixteen scoped native reads and a
diff --git a/docs/api-keys.md b/docs/api-keys.md
index 12b1eb5dde..4b5560d756 100644
--- a/docs/api-keys.md
+++ b/docs/api-keys.md
@@ -5,6 +5,10 @@ and Web Console `1.6.183`. Publication does not mean that every role/resource
 combination has passed acceptance. Use the published numeric image tag in the
 [installation guide](../README.md#quick-start).
 
+The [Server529 source candidate](releases/server-1.6.529.md) pairs Engine
+`0.183.347` with Web Console `1.6.184` for subscription terminal audit.
+Its Server publication, native acceptance and deployment remain pending.
+
 ## Access and expiry
 
 Full retains the owner's existing account/environment scope. Closed allows no
@@ -77,6 +81,14 @@ records, even when an agent schema has no `container` alias. Errors retain the
 existing API status/code/request-id and console handling; no alternate login,
 role override or secret recovery path is introduced.
 
+In the Server529 candidate, subscription close, I/O failure and live authorization
+failure retain the first terminal outcome and bounded audit delivery retry.
+Closed registrations are removed and cannot resume resource-body delivery.
+Only lifecycle metadata is retained for retry, not a token, request or grant;
+client close text and Throwable contents are not logged. The console translates
+the `subscribe` audit target even with an empty target ID. This display label is
+not a selectable policy resource and adds no authority.
+
 ## Integration and recovery
 
 Delegated Linux streams require Host API `0.38.5`, Node Agent `0.13.28` and
diff --git a/docs/performance/README.md b/docs/performance/README.md
index 95369f526f..14383bfc2f 100644
--- a/docs/performance/README.md
+++ b/docs/performance/README.md
@@ -11,6 +11,10 @@ profile; measure the real workload before increasing it further.
 The example uses the published `v1.6.528` image. See the
 [release note](../releases/server-1.6.528.md) for exact identities and acceptance limits.
 
+The [Server529 source candidate](../releases/server-1.6.529.md) does not change
+these settings. Keep the published numeric installation tag until its official
+image publication and readback; candidate startup/restart are not yet verified.
+
 ```yaml
 services:
   pasturestack-server:
diff --git a/docs/releases/server-1.6.529.md b/docs/releases/server-1.6.529.md
new file mode 100644
index 0000000000..14d31b664a
--- /dev/null
+++ b/docs/releases/server-1.6.529.md
@@ -0,0 +1,44 @@
+# Server v1.6.529
+
+Prepared source only; no Server image or release has been published.
+
+本候選組裝 Engine `v0.183.347` 與 Web Console `1.6.184`。
+Engine 補齊 API Key WebSocket 訂閱的終止稽核：保留首次關閉／失敗原因、
+清除關閉後才完成的註冊，並以既有有界排程重試終止事件傳遞。
+實際資源清理仍只執行一次；重試只保留生命週期 metadata，
+不保留 request、token、writer 或授權，也不記錄客戶端關閉文字或例外內容。
+Web 將 `subscribe` 顯示為事件訂閱，包含空 target ID 的 completion 記錄；
+這只是稽核標籤，不新增 scope picker 類型或 grant 能力。
+
+## 元件輸入與檢查範圍
+
+- Engine 正常合併來源：`09eb6950551b65c514786b4a1dee91fcfd8aa43b`。
+  `cattle.jar` SHA-256：
+  `22751db8829767d1ab9caedbca4e29de5260f26cafa677abb6f3ee0ee3c7e6f6`。
+- Web 正常合併來源：`c41fcf05b42f648d6a7e3859285b95c07b4dd40d`。
+  `web-console-1.6.184.tar.gz` SHA-256：
+  `a374e6eed0ad8daec785cc3ba833e6219d46ffd23ead77d2fd720aed5d5d52f9`。
+- Engine 30 項 focused 測試與 Web 3 項 focused unit 通過；Web 檢查包含
+  13 個正式語系的實際翻譯文字。這些是元件證據，不是 Server native PASS。
+
+Full／legacy 相容、受限 Key 的即時檢查、owner RBAC、deny precedence、
+expiry、API 契約與持久稽核上限不變。其他元件、CLI `0.6.14`、工具鏈、
+nftables、Compose／HA／runtime 設定與資料庫結構均不修改。
+安全清單只更新本版數字識別，既有 VEX 決策與 vendor-pending 條件不變。
+原歷史 Engine 負控制保留，另加入舊 346 不得冒充 347 的封裝檢查。
+
+## 尚待完成
+
+Engine 與 Web 元件已正式發行並匿名讀回相同 SHA-256 成品。
+Server 來源／封裝、安全／SBOM、必要 CodeQL、正式工作流、不可變映像
+發行與讀回仍須依原有 gates 完成。
+Server 訂閱 native 驗收、啟動／一次重啟與部署尚待驗，不宣稱完整矩陣、
+全角色、active-node 註冊生命週期或公司正式站通過。
+目前安裝文件保持已發布 `v1.6.528` 的數字 tag，不使用候選 digest。
+
+## 升級與回復
+
+只部署完成正式發行與讀回的整套 Server 映像，不在運行容器中替換 WAR。
+保留既有環境變數、三個 named volumes、restart、安全設定、HTTPS origin、
+OIDC 與 nftables 架構；部署前備份資料庫與設定並保留已驗收版本的回復點。
+來源檢查、元件發行、Server 組裝與實機驗收是不同證據，不能互相替代。
diff --git a/scripts/check-server-api-explorer-patch.sh b/scripts/check-server-api-explorer-patch.sh
index 6223d4c068..edd7a03406 100755
--- a/scripts/check-server-api-explorer-patch.sh
+++ b/scripts/check-server-api-explorer-patch.sh
@@ -526,7 +526,7 @@ require_marker "$release_dockerfile" \
     'ARG BASE_IMAGE=ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403' \
     SERVER_INCREMENTAL_RELEASE_BASE_MISSING
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.528' \
+    'ARG SERVER_RELEASE_TAG=v1.6.529' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -567,16 +567,16 @@ require_marker "$publish_workflow" \
     'bash source/server/artifacts/verify-host-api-package.sh' \
     SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.183' \
+    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.184' \
     SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.183.tar.gz' \
+    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.184.tar.gz' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT_SHA256=8540758ad4521f901f53fc79473570cf98862add2addcb49271d8dbf125b4217' \
+    'ARG WEB_CONSOLE_ARTIFACT_SHA256=a374e6eed0ad8daec785cc3ba833e6219d46ffd23ead77d2fd720aed5d5d52f9' \
     SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_COMMIT=e056a0111d20816742eff17a65dfabb5d003dae2' \
+    'ARG WEB_CONSOLE_COMMIT=c41fcf05b42f648d6a7e3859285b95c07b4dd40d' \
     SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING
 require_marker "$release_dockerfile" \
     "grep -aF 'hostsPage.permissionDenied'" \
@@ -585,16 +585,16 @@ require_marker "$release_dockerfile" \
     '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING
 require_marker "$build_script" \
-    'web_console_commit=${WEB_CONSOLE_COMMIT:-e056a0111d20816742eff17a65dfabb5d003dae2}' \
+    'web_console_commit=${WEB_CONSOLE_COMMIT:-c41fcf05b42f648d6a7e3859285b95c07b4dd40d}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING
 require_marker "$build_script" \
-    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.183}' \
+    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.184}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.183.tar.gz}' \
+    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.184.tar.gz}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING
 require_marker "$build_script" \
-    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-8540758ad4521f901f53fc79473570cf98862add2addcb49271d8dbf125b4217}' \
+    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-a374e6eed0ad8daec785cc3ba833e6219d46ffd23ead77d2fd720aed5d5d52f9}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING
 require_marker "$release_dockerfile" \
     'ARG CATALOG_SERVICE_VERSION=0.20.13' \
@@ -1059,21 +1059,21 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.528}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.529}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.528}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.529}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
     SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING
 for release_engine_marker in \
-    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.346' \
+    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.347' \
     'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar' \
-    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=9deeda5758b7f04135441a203092dd0308d90b65d25037b62ef4f9361d3cf806' \
-    'ARG ORCHESTRATION_ENGINE_COMMIT=e250e4a17958216c30c1f5d0d31f7b6418a968d5' \
+    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=22751db8829767d1ab9caedbca4e29de5260f26cafa677abb6f3ee0ee3c7e6f6' \
+    'ARG ORCHESTRATION_ENGINE_COMMIT=09eb6950551b65c514786b4a1dee91fcfd8aa43b' \
     'COPY --from=release_artifacts /out/orchestration-engine.jar /tmp/orchestration-engine.jar' \
-    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.346' \
+    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.347' \
     'grep -Fx "Implementation-Version: ${ORCHESTRATION_ENGINE_VERSION}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar' \
@@ -1094,10 +1094,10 @@ for release_engine_marker in \
         SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING
 done
 for release_engine_build_marker in \
-    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.346}' \
+    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.347}' \
     'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}' \
-    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-9deeda5758b7f04135441a203092dd0308d90b65d25037b62ef4f9361d3cf806}' \
-    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-e250e4a17958216c30c1f5d0d31f7b6418a968d5}' \
+    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-22751db8829767d1ab9caedbca4e29de5260f26cafa677abb6f3ee0ee3c7e6f6}' \
+    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-09eb6950551b65c514786b4a1dee91fcfd8aa43b}' \
     'CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'test "${hazelcast_entry}" = "WEB-INF/lib/hazelcast-5.7.5.jar"'; do
@@ -2146,7 +2146,7 @@ done
 
 jq -e '
   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.528"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.529"
   and (.statements | length) == 51
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2172,7 +2172,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.528 >/dev/null
+    "$vendor_pending_fixture" v1.6.529 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2261,4 +2261,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.528 base=v1.6.460 engine=0.183.346 web_console=1.6.183 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.529 base=v1.6.460 engine=0.183.347 web_console=1.6.184 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
diff --git a/scripts/test-current-server-packaging-contract.py b/scripts/test-current-server-packaging-contract.py
index 3dc91e08c6..cf0e82e043 100644
--- a/scripts/test-current-server-packaging-contract.py
+++ b/scripts/test-current-server-packaging-contract.py
@@ -17,21 +17,21 @@
 PUBLISHED_508 = 'Server `v1.6.508` 已正式發布，封裝 Web Console `1.6.171`。'
 STALE_508_CANDIDATE = 'Server `v1.6.508` candidate packages Web Console `1.6.171`'
 COMPATIBILITY_CODE = 'SERVER_CREATE_RESPONSE_ORDER_COMPATIBILITY_MISSING'
-WEB_SHA = '8540758ad4521f901f53fc79473570cf98862add2addcb49271d8dbf125b4217'
-WEB_SOURCE = 'e056a0111d20816742eff17a65dfabb5d003dae2'
+WEB_SHA = 'a374e6eed0ad8daec785cc3ba833e6219d46ffd23ead77d2fd720aed5d5d52f9'
+WEB_SOURCE = 'c41fcf05b42f648d6a7e3859285b95c07b4dd40d'
 CATALOG_COMMIT = 'b6b658888fce50d3ec217eb4eba0f26ab0113baf'
-ENGINE_SHA = '9deeda5758b7f04135441a203092dd0308d90b65d25037b62ef4f9361d3cf806'
-ENGINE_SOURCE = 'e250e4a17958216c30c1f5d0d31f7b6418a968d5'
+ENGINE_SHA = '22751db8829767d1ab9caedbca4e29de5260f26cafa677abb6f3ee0ee3c7e6f6'
+ENGINE_SOURCE = '09eb6950551b65c514786b4a1dee91fcfd8aa43b'
 OLD_COORDINATES = {
-    'v1.6.528': 'v1.6.521',
-    '1.6.183': '1.6.181',
+    'v1.6.529': 'v1.6.521',
+    '1.6.184': '1.6.181',
     WEB_SHA: '9199681f2c4311f3fbe8727fcf0f6fa136c9bafe9fbe9d13878c55df442a7a03',
     WEB_SOURCE: '7f2bdad0c90a3241693c2ddd4475202ababba550',
     CATALOG_COMMIT: '7670ffd81d5f0b5570197fb03c7e55b46da45bf3',
 }
-# Engine346 and Web183 use independently read-back official release identities.
+# Engine347 and Web184 use the reviewed component input identities.
 # Published521 component values remain mutation controls.
-# Component coordinates do not establish Server528 artifact/runtime PASS.
+# Component coordinates do not establish Server529 artifact/runtime PASS.
 CATALOG_FIELDS = (
     ('VERSION', 'version', '0.20.13'),
     ('COMMIT', 'commit', '4c39c73a8131ba06e9ff0aaec3b95cc27e049324'),
@@ -41,25 +41,25 @@
     ('LICENSE_SHA256', 'license_sha256', '0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594'),
 )
 LEGACY_ENGINE_COORDINATES = {
-    '0.183.346': '0.183.337',
+    '0.183.347': '0.183.337',
     ENGINE_SHA: '7e45189f2b57097efc7929c04ddf7767aebbe027d1b9f90023aa6711522c5c80',
     ENGINE_SOURCE: 'ba041fe312dfe97fc1e5144af576ddcf1b573d8e',
 }
 EXPECTED = {
     COMPATIBILITY_CODE: (COMPATIBILITY, PUBLISHED_508),
-    'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.528'),
+    'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.529'),
     'SERVER_INCREMENTAL_RELEASE_VERSION_MISSING': (DOCKER, 'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"'),
     'SERVER_INCREMENTAL_RELEASE_RUNTIME_VERSION_MISSING': (DOCKER, 'ENV CATTLE_RANCHER_SERVER_VERSION=${SERVER_RELEASE_TAG}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.183'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.183.tar.gz'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.184'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.184.tar.gz'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT_SHA256=' + WEB_SHA),
     'SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_COMMIT=' + WEB_SOURCE),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING': (BUILD, 'web_console_commit=${WEB_CONSOLE_COMMIT:-' + WEB_SOURCE + '}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.183}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.183.tar.gz}'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.184}'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.184.tar.gz}'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING': (BUILD, 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-' + WEB_SHA + '}'),
-    'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.528}'),
-    'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.528}'),
+    'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.529}'),
+    'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.529}'),
     'SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING': (BUILD, 'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"'),
     'SERVER_WEB_CONSOLE_RUNTIME_VERSION_GATE_MISSING': (BUILD, 'test "$(cat "${web_root}/VERSION.txt")" = "${WEB_CONSOLE_RELEASE_TAG}"'),
     'SERVER_VOLUME_NATIVE_READ_ONLY_BUILD_GATE_MISSING': (DOCKER, 'grep -F \'"volume.isNative" : "r"\' >/dev/null'),
@@ -80,18 +80,18 @@
 CREATE_RESPONSE_CODES = ['SERVER_WEB_CREATE_IDENTITY_BUILD_GATE_MISSING','SERVER_WEB_CANONICAL_RECORD_BUILD_GATE_MISSING','SERVER_WEB_CREATE_IDENTITY_RUNTIME_GATE_MISSING','SERVER_WEB_CANONICAL_RECORD_RUNTIME_GATE_MISSING']
 ENGINE_EXPECTED = {
     'SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING': (DOCKER, 'release_engine_marker', (
-        'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.346',
+        'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.347',
         'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar',
         'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=' + ENGINE_SHA,
         'ARG ORCHESTRATION_ENGINE_COMMIT=' + ENGINE_SOURCE,
-        'ARG ORCHESTRATION_ENGINE_VERSION=0.183.346',
+        'ARG ORCHESTRATION_ENGINE_VERSION=0.183.347',
         'grep -Fx "Implementation-Version: ${ORCHESTRATION_ENGINE_VERSION}"',
         'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar',
         'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar',
         'ENV CATTLE_CATTLE_VERSION=${ORCHESTRATION_ENGINE_RELEASE_TAG}',
     )),
     'SERVER_INCREMENTAL_ENGINE_BUILD_COORDINATE_MISSING': (BUILD, 'release_engine_build_marker', (
-        'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.346}',
+        'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.347}',
         'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}',
         'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-' + ENGINE_SHA + '}',
         'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-' + ENGINE_SOURCE + '}',
@@ -470,15 +470,15 @@ def verify(files, gate=GATE):
                 pipeline = r'(?:^|[;\n])\s*' + re.escape(marker) + r'(?=\s*(?:;|\n|$))'
                 if len(re.findall(pipeline, source)) != 1:
                     raise AssertionError('CURRENT_CATALOG_HASH_BYPASS')
-    if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.528"' not in gate:
+    if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.529"' not in gate:
         raise AssertionError('CURRENT_VEX_GATE_PIN_MISMATCH')
-    if '"$vendor_pending_fixture" v1.6.528 >/dev/null' not in gate:
+    if '"$vendor_pending_fixture" v1.6.529 >/dev/null' not in gate:
         raise AssertionError('CURRENT_VENDOR_GATE_PIN_MISMATCH')
-    if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.528':
+    if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.529':
         raise AssertionError('CURRENT_VEX_RELEASE_MISMATCH')
-    if json.loads(files[VENDOR]).get('release') != 'v1.6.528':
+    if json.loads(files[VENDOR]).get('release') != 'v1.6.529':
         raise AssertionError('CURRENT_VENDOR_RELEASE_MISMATCH')
-    if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.528 base=v1.6.460 engine=0.183.346 web_console=1.6.183 catalog_service=0.20.13 ' not in gate:
+    if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.529 base=v1.6.460 engine=0.183.347 web_console=1.6.184 catalog_service=0.20.13 ' not in gate:
         raise AssertionError('CURRENT_SUMMARY_MISMATCH')
     verify_incremental_contract(files, gate)
 
@@ -492,11 +492,11 @@ def previous_gate(gate=GATE):
         if stale(marker) != marker:
             replacements["'" + marker + "' "] = "'" + stale(marker) + "' "
     replacements.update({
-        'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.528"':
+        'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.529"':
             'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.521"',
-        '"$vendor_pending_fixture" v1.6.528 >/dev/null':
+        '"$vendor_pending_fixture" v1.6.529 >/dev/null':
             '"$vendor_pending_fixture" v1.6.521 >/dev/null',
-        'SERVER_API_EXPLORER_PATCH_OK release=v1.6.528 base=v1.6.460 engine=0.183.346 web_console=1.6.183 catalog_service=0.20.13 ':
+        'SERVER_API_EXPLORER_PATCH_OK release=v1.6.529 base=v1.6.460 engine=0.183.347 web_console=1.6.184 catalog_service=0.20.13 ':
             'SERVER_API_EXPLORER_PATCH_OK release=v1.6.521 base=v1.6.460 engine=0.183.340 web_console=1.6.181 catalog_service=0.20.12 ',
     })
     for marker, stale_marker in replacements.items():
@@ -936,7 +936,7 @@ def test_each_old_engine_coordinate_rejected(self):
         self.assertGreater(checked, 0)
 
     def test_historical_engine340_cannot_be_packaged(self):
-        old = {'0.183.346': '0.183.340',
+        old = {'0.183.347': '0.183.340',
                ENGINE_SHA: '5e5a1b908b43bf3824fc3bb2108bd661cd5199ce9bcfd187e0b18b5608a38cea',
                ENGINE_SOURCE: 'ff0a41e7676211043eb4f755a306a9e2a19abee1'}
         checked = 0
@@ -957,7 +957,7 @@ def test_historical_engine340_cannot_be_packaged(self):
 
 
     def test_immediately_previous_engine341_cannot_be_packaged(self):
-        old = {'0.183.346': '0.183.341',
+        old = {'0.183.347': '0.183.341',
                ENGINE_SHA: '3ede1ad28b7a7e0754c4c953bd486162f7ffe0b2f76ce384ec485632af6b8e6d',
                ENGINE_SOURCE: 'b245cf778479445ded0786d3898b03fea153212e'}
         checked = 0
@@ -978,7 +978,7 @@ def test_immediately_previous_engine341_cannot_be_packaged(self):
 
 
     def test_immediately_previous_engine342_cannot_be_packaged(self):
-        old = {'0.183.346': '0.183.342',
+        old = {'0.183.347': '0.183.342',
                ENGINE_SHA: '3533f247392795329c92516a7966510aafbe81a52e3f922e5ec657a2071363b5',
                ENGINE_SOURCE: 'ddae4bb8e12806f70816f5782cd999eccd0f2ce6'}
         checked = 0
@@ -999,7 +999,7 @@ def test_immediately_previous_engine342_cannot_be_packaged(self):
 
 
     def test_immediately_previous_engine343_cannot_be_packaged(self):
-        old = {'0.183.346': '0.183.343',
+        old = {'0.183.347': '0.183.343',
                ENGINE_SHA: 'b29c0057f96dbae38bfe2c663c63bbe4c8b5c755b3090f39414aa51f9813025f',
                ENGINE_SOURCE: '5aa9d8978c75a7fe63330453c399a92716d88568'}
         checked = 0
@@ -1020,7 +1020,7 @@ def test_immediately_previous_engine343_cannot_be_packaged(self):
 
 
     def test_immediately_previous_engine344_cannot_be_packaged(self):
-        old = {'0.183.346': '0.183.344',
+        old = {'0.183.347': '0.183.344',
                ENGINE_SHA: 'ffafa4700156b74ec11bcae1b830738e49943f1a3b8b0565895ed6d7726eebf1',
                ENGINE_SOURCE: '72c42e6f2000301fe03ffd2442fb9ee89aee120c'}
         checked = 0
@@ -1040,7 +1040,7 @@ def test_immediately_previous_engine344_cannot_be_packaged(self):
         self.assertGreater(checked, 0)
 
     def test_immediately_previous_engine345_cannot_be_packaged(self):
-        old = {'0.183.346': '0.183.345',
+        old = {'0.183.347': '0.183.345',
                ENGINE_SHA: '780263c4a884527fa80a28b998ad4bda88b9ad6002a687f9f074602ecad46e62',
                ENGINE_SOURCE: 'd27d4ac73fa05ae43b9ae0c32875780e8a3765b1'}
         checked = 0
@@ -1059,6 +1059,26 @@ def test_immediately_previous_engine345_cannot_be_packaged(self):
                         verify(files)
         self.assertGreater(checked, 0)
 
+    def test_immediately_previous_engine346_cannot_be_packaged(self):
+        old = {'0.183.347': '0.183.346',
+               ENGINE_SHA: '9deeda5758b7f04135441a203092dd0308d90b65d25037b62ef4f9361d3cf806',
+               ENGINE_SOURCE: 'e250e4a17958216c30c1f5d0d31f7b6418a968d5'}
+        checked = 0
+        for code, (name, _, markers) in ENGINE_EXPECTED.items():
+            for marker in markers:
+                previous = marker
+                for current, stale_value in old.items():
+                    previous = previous.replace(current, stale_value)
+                if previous == marker:
+                    continue
+                checked += 1
+                with self.subTest(name=name, marker=marker):
+                    files = dict(FILES)
+                    files[name] = files[name].replace(marker, previous)
+                    with self.assertRaisesRegex(AssertionError, code):
+                        verify(files)
+        self.assertGreater(checked, 0)
+
     def test_previous_fixture_rejects_stale_web179_pins(self):
         gate = previous_gate()
         for code, (_, marker) in EXPECTED.items():
diff --git a/server/Dockerfile.web-compose-release b/server/Dockerfile.web-compose-release
index 78cf4f36bd..4dc18d93a0 100644
--- a/server/Dockerfile.web-compose-release
+++ b/server/Dockerfile.web-compose-release
@@ -55,9 +55,9 @@ ARG NODE_AGENT_BINARY_SHA256=ce8342e10da07c50cc414b471cadc67db4dd390e6e2dcb632b3
 ARG NODE_AGENT_APPLY_SHA256=dd8cb342518a43e7468cc121db5c4e44b16731f2620b77ea0fd03c02c03766a9
 
 ARG WEB_CONSOLE_RELEASE_BASE_URL=https://github.com/PastureStack/web-console/releases/download
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.183
-ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.183.tar.gz
-ARG WEB_CONSOLE_ARTIFACT_SHA256=8540758ad4521f901f53fc79473570cf98862add2addcb49271d8dbf125b4217
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.184
+ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.184.tar.gz
+ARG WEB_CONSOLE_ARTIFACT_SHA256=a374e6eed0ad8daec785cc3ba833e6219d46ffd23ead77d2fd720aed5d5d52f9
 ARG CATALOG_SERVICE_RELEASE_BASE_URL=https://github.com/PastureStack/catalog-service/releases/download
 ARG CATALOG_SERVICE_VERSION=0.20.13
 ARG CATALOG_SERVICE_COMMIT=4c39c73a8131ba06e9ff0aaec3b95cc27e049324
@@ -79,9 +79,9 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.4
 ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=49c4579829a04e758045fae02a5a9fca12bb0ba3af0d5e979cf9eb97f23a88a9
 ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=98c7faea665b7eb95206b8c73a6f47d644c5d2d0eae53f274f6a15faf5205744
 ARG ORCHESTRATION_ENGINE_RELEASE_BASE_URL=https://github.com/PastureStack/orchestration-engine/releases/download
-ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.346
+ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.347
 ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar
-ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=9deeda5758b7f04135441a203092dd0308d90b65d25037b62ef4f9361d3cf806
+ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=22751db8829767d1ab9caedbca4e29de5260f26cafa677abb6f3ee0ee3c7e6f6
 ARG COMPOSE_EXECUTOR_RELEASE_BASE_URL=https://github.com/PastureStack/compose-cli/releases/download
 ARG COMPOSE_EXECUTOR_VERSION=0.14.37
 ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=5ff465601930218f531885a384f231d969033e4cef794ce33d16bfe24e5c1c81
@@ -568,9 +568,9 @@ FROM ${BASE_IMAGE}
 
 ARG SOURCE_DATE_EPOCH
 ARG PASTURESTACK_SERVER_REVISION
-ARG SERVER_RELEASE_TAG=v1.6.528
-ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.346
-ARG ORCHESTRATION_ENGINE_VERSION=0.183.346
+ARG SERVER_RELEASE_TAG=v1.6.529
+ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.347
+ARG ORCHESTRATION_ENGINE_VERSION=0.183.347
 ARG ENGINE_READONLY_SCHEMA_SHA256=7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233
 ARG ENGINE_RESTRICTED_SCHEMA_SHA256=f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51
 ARG HOST_API_VERSION=0.38.5
@@ -588,9 +588,9 @@ ARG FREETYPE_PACKAGE_VERSION=2.14.2+dfsg-1ubuntu0.2
 ARG LIBPNG_PACKAGE_VERSION=1.6.57-1ubuntu0.1
 ARG GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4
 ARG PERL_PACKAGE_VERSION=5.40.1-7ubuntu0.3
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.183
-ARG WEB_CONSOLE_ARTIFACT_SHA256=8540758ad4521f901f53fc79473570cf98862add2addcb49271d8dbf125b4217
-ARG WEB_CONSOLE_COMMIT=e056a0111d20816742eff17a65dfabb5d003dae2
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.184
+ARG WEB_CONSOLE_ARTIFACT_SHA256=a374e6eed0ad8daec785cc3ba833e6219d46ffd23ead77d2fd720aed5d5d52f9
+ARG WEB_CONSOLE_COMMIT=c41fcf05b42f648d6a7e3859285b95c07b4dd40d
 ARG CATALOG_SERVICE_VERSION=0.20.13
 ARG CATALOG_SERVICE_COMMIT=4c39c73a8131ba06e9ff0aaec3b95cc27e049324
 ARG CATALOG_SERVICE_ARCHIVE_SHA256=29626181cb8489b016e5975ffaddc00b2a32d290b1c0066e833d27fa7a5edf83
@@ -609,8 +609,8 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.4
 ARG WEBHOOK_AUTOMATION_SERVICE_COMMIT=400118b893843d2a7d7c65cc70c3449d76c4a8d8
 ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=49c4579829a04e758045fae02a5a9fca12bb0ba3af0d5e979cf9eb97f23a88a9
 ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=98c7faea665b7eb95206b8c73a6f47d644c5d2d0eae53f274f6a15faf5205744
-ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=9deeda5758b7f04135441a203092dd0308d90b65d25037b62ef4f9361d3cf806
-ARG ORCHESTRATION_ENGINE_COMMIT=e250e4a17958216c30c1f5d0d31f7b6418a968d5
+ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=22751db8829767d1ab9caedbca4e29de5260f26cafa677abb6f3ee0ee3c7e6f6
+ARG ORCHESTRATION_ENGINE_COMMIT=09eb6950551b65c514786b4a1dee91fcfd8aa43b
 ARG HOST_PROVISIONER_VERSION=0.39.8
 ARG HOST_PROVISIONER_COMMIT=385e5b536c108f17fdfcdec84c01750a5be5ab1c
 ARG HOST_PROVISIONER_ARCHIVE_SHA256=d775f36a613b1a486a5e60d6ad61fdbd1ebb4bd22422cbb6dcb70fdd7c4abf0c
diff --git a/server/build-api-explorer-patch-image.sh b/server/build-api-explorer-patch-image.sh
index 7bfca8cee4..4c74bf5529 100755
--- a/server/build-api-explorer-patch-image.sh
+++ b/server/build-api-explorer-patch-image.sh
@@ -14,14 +14,14 @@ if [[ -n "$(git status --porcelain --untracked-files=normal)" ]]; then
 fi
 
 revision=${PASTURESTACK_SERVER_REVISION:-$(git rev-parse HEAD)}
-server_release_tag=${SERVER_RELEASE_TAG:-v1.6.528}
+server_release_tag=${SERVER_RELEASE_TAG:-v1.6.529}
 source_date_epoch=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)}
 base_image=${BASE_IMAGE:-ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403}
 orchestration_engine_release_base_url=${ORCHESTRATION_ENGINE_RELEASE_BASE_URL:-https://github.com/PastureStack/orchestration-engine/releases/download}
-orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.346}
+orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.347}
 orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}
-orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-9deeda5758b7f04135441a203092dd0308d90b65d25037b62ef4f9361d3cf806}
-orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-e250e4a17958216c30c1f5d0d31f7b6418a968d5}
+orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-22751db8829767d1ab9caedbca4e29de5260f26cafa677abb6f3ee0ee3c7e6f6}
+orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-09eb6950551b65c514786b4a1dee91fcfd8aa43b}
 orchestration_engine_version=${orchestration_engine_release_tag#v}
 engine_readonly_schema_sha256=${ENGINE_READONLY_SCHEMA_SHA256:-7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233}
 engine_restricted_schema_sha256=${ENGINE_RESTRICTED_SCHEMA_SHA256:-f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51}
@@ -48,10 +48,10 @@ api_explorer_artifact=${API_EXPLORER_ARTIFACT:-api-explorer-1.1.18.tar.gz}
 api_explorer_artifact_sha256=${API_EXPLORER_ARTIFACT_SHA256:-92b718c46163018ea40c008ac552911f0eb610647377725405f4046dcd411f2c}
 api_explorer_commit=${API_EXPLORER_COMMIT:-3b1c39e8a116f58649d94233a384a0362c02b43e}
 web_console_release_base_url=${WEB_CONSOLE_RELEASE_BASE_URL:-https://github.com/PastureStack/web-console/releases/download}
-web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.183}
-web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.183.tar.gz}
-web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-8540758ad4521f901f53fc79473570cf98862add2addcb49271d8dbf125b4217}
-web_console_commit=${WEB_CONSOLE_COMMIT:-e056a0111d20816742eff17a65dfabb5d003dae2}
+web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.184}
+web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.184.tar.gz}
+web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-a374e6eed0ad8daec785cc3ba833e6219d46ffd23ead77d2fd720aed5d5d52f9}
+web_console_commit=${WEB_CONSOLE_COMMIT:-c41fcf05b42f648d6a7e3859285b95c07b4dd40d}
 catalog_service_release_base_url=${CATALOG_SERVICE_RELEASE_BASE_URL:-https://github.com/PastureStack/catalog-service/releases/download}
 catalog_service_version=${CATALOG_SERVICE_VERSION:-0.20.13}
 catalog_service_commit=${CATALOG_SERVICE_COMMIT:-4c39c73a8131ba06e9ff0aaec3b95cc27e049324}
@@ -101,7 +101,7 @@ usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-5ce
 usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-e62a21270142181315293d7e11482288ffe8fc4d91cc8fe07dacc90b461f3709}
 supported_docker_range='~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0'
 newest_docker_version=v29.8.0
-image=${IMAGE:-pasturestack-validation/server:v1.6.528}
+image=${IMAGE:-pasturestack-validation/server:v1.6.529}
 build_options=()
 
 [[ "$revision" =~ ^[0-9a-f]{40}$ ]]
diff --git a/server/build-component-candidate.sh b/server/build-component-candidate.sh
index ec62d08ed6..04df10347e 100755
--- a/server/build-component-candidate.sh
+++ b/server/build-component-candidate.sh
@@ -14,10 +14,10 @@ for name in "${required[@]}"; do
     case "$name" in *_COMMIT) [[ ${!name} =~ ^[0-9a-f]{40}$ ]] ;; *) [[ ${!name} =~ ^[0-9a-f]{64}$ ]] ;; esac
     export "$name"
 done
-export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.528}
-export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.346}
+export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.529}
+export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.347}
 export ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar
-export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.183}
+export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.184}
 export WEB_CONSOLE_ARTIFACT="web-console-${WEB_CONSOLE_RELEASE_TAG}.tar.gz"
 export WEBSOCKET_PROXY_VERSION=${WEBSOCKET_PROXY_VERSION:-0.23.15}
 export HOST_API_VERSION=${HOST_API_VERSION:-0.38.5}
diff --git a/server/security/openvex.json b/server/security/openvex.json
index 55a8f42a5e..db72197146 100644
--- a/server/security/openvex.json
+++ b/server/security/openvex.json
@@ -1,6 +1,6 @@
 {
   "@context": "https://openvex.dev/ns/v0.2.0",
-  "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.528",
+  "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.529",
   "author": "PastureStack Security",
   "timestamp": "2026-10-02T22:05:00Z",
   "version": 51,
diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json
index 885751b1a3..5e3c1fcfef 100644
--- a/server/security/vendor-pending.json
+++ b/server/security/vendor-pending.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "release": "v1.6.528",
+  "release": "v1.6.529",
   "generatedAt": "2026-10-10T00:00:00Z",
   "policy": {
     "allowedSeverities": [