fix(audit): package subscription lifecycle Engine347 and Web184

COMPATIBILITY.md

@@ -1,5 +1,20 @@
 # Compatibility Contract
 
+## Server v1.6.529 source candidate
+
+The candidate pairs Engine `v0.183.347` with Web Console `1.6.184`.
+Subscription terminal audit retains the first close/failure result, bounded
+delivery retry and exactly-once physical cleanup without restoring authorization.
+The console labels event subscriptions, including completion records without a
+target ID; this adds no resource-picker or grant capability. Full/legacy behavior,
+live restricted-Key checks, owner RBAC and audit bounds remain unchanged.
+
+Thirty focused Engine tests and three focused Web unit tests, including actual
+labels in all thirteen production locales, passed at the component level.
+Server publication, immutable image readback, native acceptance and deployment
+remain pending; the published installation pairing below remains `v1.6.528`.
+See the [candidate note](docs/releases/server-1.6.529.md) for exact input identities.
+
 ## Server v1.6.528 published
 
 This release packages Engine `v0.183.346` and unchanged Web Console `1.6.183`.

README.md

@@ -21,6 +21,12 @@ without granting ordinary read/list access or broader resource scope.
 Stack-scoped Container and Instance Link queries retain live ancestry checks
 and work with MariaDB's default optimizer, including nullable Stack references.
 
+The `v1.6.529` source candidate pairs Engine `v0.183.347` with Web Console
+`1.6.184` for subscription terminal audit and its translated target label.
+Component focused checks are separate from Server publication, native acceptance
+and deployment, which remain pending. See the [candidate note](docs/releases/server-1.6.529.md).
+Installation examples below remain on the published `v1.6.528` image.
+
 Registration tokens use dedicated Basic authentication. Native project creation
 preserves the creator's initial membership and default networks. HA database
 exports return a SQL ZIP only after successful, nonempty output; failures clean

docs/README.md

@@ -7,6 +7,11 @@ runtime gates have passed.
 
 ## Release notes
 
+- [Server v1.6.529](releases/server-1.6.529.md) — source candidate with Engine
+  `0.183.347` and Web Console `1.6.184` for subscription terminal audit and its
+  translated target label. Server publication, native acceptance and deployment
+  remain pending; use the published `v1.6.528` installation guide below.
+
 - [Server v1.6.528](releases/server-1.6.528.md) — published with Engine
   `0.183.346` and unchanged Web Console `1.6.183`; fixes MariaDB Stack-ancestry
   queries without expanding authorization. Sixteen scoped native reads and a

docs/api-keys.md

@@ -5,6 +5,10 @@ and Web Console `1.6.183`. Publication does not mean that every role/resource
 combination has passed acceptance. Use the published numeric image tag in the
 [installation guide](../README.md#quick-start).
 
+The [Server529 source candidate](releases/server-1.6.529.md) pairs Engine
+`0.183.347` with Web Console `1.6.184` for subscription terminal audit.
+Its Server publication, native acceptance and deployment remain pending.
+
 ## Access and expiry
 
 Full retains the owner's existing account/environment scope. Closed allows no
@@ -77,6 +81,14 @@ records, even when an agent schema has no `container` alias. Errors retain the
 existing API status/code/request-id and console handling; no alternate login,
 role override or secret recovery path is introduced.
 
+In the Server529 candidate, subscription close, I/O failure and live authorization
+failure retain the first terminal outcome and bounded audit delivery retry.
+Closed registrations are removed and cannot resume resource-body delivery.
+Only lifecycle metadata is retained for retry, not a token, request or grant;
+client close text and Throwable contents are not logged. The console translates
+the `subscribe` audit target even with an empty target ID. This display label is
+not a selectable policy resource and adds no authority.
+
 ## Integration and recovery
 
 Delegated Linux streams require Host API `0.38.5`, Node Agent `0.13.28` and

docs/performance/README.md

@@ -11,6 +11,10 @@ profile; measure the real workload before increasing it further.
 The example uses the published `v1.6.528` image. See the
 [release note](../releases/server-1.6.528.md) for exact identities and acceptance limits.
 
+The [Server529 source candidate](../releases/server-1.6.529.md) does not change
+these settings. Keep the published numeric installation tag until its official
+image publication and readback; candidate startup/restart are not yet verified.
+
 ```yaml
 services:
   pasturestack-server:

docs/releases/server-1.6.529.md

@@ -0,0 +1,44 @@
+# Server v1.6.529
+
+Prepared source only; no Server image or release has been published.
+
+本候選組裝 Engine `v0.183.347` 與 Web Console `1.6.184`。
+Engine 補齊 API Key WebSocket 訂閱的終止稽核：保留首次關閉／失敗原因、
+清除關閉後才完成的註冊，並以既有有界排程重試終止事件傳遞。
+實際資源清理仍只執行一次；重試只保留生命週期 metadata，
+不保留 request、token、writer 或授權，也不記錄客戶端關閉文字或例外內容。
+Web 將 `subscribe` 顯示為事件訂閱，包含空 target ID 的 completion 記錄；
+這只是稽核標籤，不新增 scope picker 類型或 grant 能力。
+
+## 元件輸入與檢查範圍
+
+- Engine 正常合併來源：`09eb6950551b65c514786b4a1dee91fcfd8aa43b`。
+  `cattle.jar` SHA-256：
+  `22751db8829767d1ab9caedbca4e29de5260f26cafa677abb6f3ee0ee3c7e6f6`。
+- Web 正常合併來源：`c41fcf05b42f648d6a7e3859285b95c07b4dd40d`。
+  `web-console-1.6.184.tar.gz` SHA-256：
+  `a374e6eed0ad8daec785cc3ba833e6219d46ffd23ead77d2fd720aed5d5d52f9`。
+- Engine 30 項 focused 測試與 Web 3 項 focused unit 通過；Web 檢查包含
+  13 個正式語系的實際翻譯文字。這些是元件證據，不是 Server native PASS。
+
+Full／legacy 相容、受限 Key 的即時檢查、owner RBAC、deny precedence、
+expiry、API 契約與持久稽核上限不變。其他元件、CLI `0.6.14`、工具鏈、
+nftables、Compose／HA／runtime 設定與資料庫結構均不修改。
+安全清單只更新本版數字識別，既有 VEX 決策與 vendor-pending 條件不變。
+原歷史 Engine 負控制保留，另加入舊 346 不得冒充 347 的封裝檢查。
+
+## 尚待完成
+
+Engine 與 Web 元件已正式發行並匿名讀回相同 SHA-256 成品。
+Server 來源／封裝、安全／SBOM、必要 CodeQL、正式工作流、不可變映像
+發行與讀回仍須依原有 gates 完成。
+Server 訂閱 native 驗收、啟動／一次重啟與部署尚待驗，不宣稱完整矩陣、
+全角色、active-node 註冊生命週期或公司正式站通過。
+目前安裝文件保持已發布 `v1.6.528` 的數字 tag，不使用候選 digest。
+
+## 升級與回復
+
+只部署完成正式發行與讀回的整套 Server 映像，不在運行容器中替換 WAR。
+保留既有環境變數、三個 named volumes、restart、安全設定、HTTPS origin、
+OIDC 與 nftables 架構；部署前備份資料庫與設定並保留已驗收版本的回復點。
+來源檢查、元件發行、Server 組裝與實機驗收是不同證據，不能互相替代。

scripts/check-server-api-explorer-patch.sh

@@ -526,7 +526,7 @@ require_marker "$release_dockerfile" \
     'ARG BASE_IMAGE=ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403' \
     SERVER_INCREMENTAL_RELEASE_BASE_MISSING
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.528' \
+    'ARG SERVER_RELEASE_TAG=v1.6.529' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -567,16 +567,16 @@ require_marker "$publish_workflow" \
     'bash source/server/artifacts/verify-host-api-package.sh' \
     SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.183' \
+    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.184' \
     SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.183.tar.gz' \
+    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.184.tar.gz' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT_SHA256=8540758ad4521f901f53fc79473570cf98862add2addcb49271d8dbf125b4217' \
+    'ARG WEB_CONSOLE_ARTIFACT_SHA256=a374e6eed0ad8daec785cc3ba833e6219d46ffd23ead77d2fd720aed5d5d52f9' \
     SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_COMMIT=e056a0111d20816742eff17a65dfabb5d003dae2' \
+    'ARG WEB_CONSOLE_COMMIT=c41fcf05b42f648d6a7e3859285b95c07b4dd40d' \
     SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING
 require_marker "$release_dockerfile" \
     "grep -aF 'hostsPage.permissionDenied'" \
@@ -585,16 +585,16 @@ require_marker "$release_dockerfile" \
     '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING
 require_marker "$build_script" \
-    'web_console_commit=${WEB_CONSOLE_COMMIT:-e056a0111d20816742eff17a65dfabb5d003dae2}' \
+    'web_console_commit=${WEB_CONSOLE_COMMIT:-c41fcf05b42f648d6a7e3859285b95c07b4dd40d}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING
 require_marker "$build_script" \
-    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.183}' \
+    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.184}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.183.tar.gz}' \
+    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.184.tar.gz}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING
 require_marker "$build_script" \
-    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-8540758ad4521f901f53fc79473570cf98862add2addcb49271d8dbf125b4217}' \
+    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-a374e6eed0ad8daec785cc3ba833e6219d46ffd23ead77d2fd720aed5d5d52f9}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING
 require_marker "$release_dockerfile" \
     'ARG CATALOG_SERVICE_VERSION=0.20.13' \
@@ -1059,21 +1059,21 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.528}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.529}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.528}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.529}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
     SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING
 for release_engine_marker in \
-    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.346' \
+    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.347' \
     'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar' \
-    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=9deeda5758b7f04135441a203092dd0308d90b65d25037b62ef4f9361d3cf806' \
-    'ARG ORCHESTRATION_ENGINE_COMMIT=e250e4a17958216c30c1f5d0d31f7b6418a968d5' \
+    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=22751db8829767d1ab9caedbca4e29de5260f26cafa677abb6f3ee0ee3c7e6f6' \
+    'ARG ORCHESTRATION_ENGINE_COMMIT=09eb6950551b65c514786b4a1dee91fcfd8aa43b' \
     'COPY --from=release_artifacts /out/orchestration-engine.jar /tmp/orchestration-engine.jar' \
-    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.346' \
+    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.347' \
     'grep -Fx "Implementation-Version: ${ORCHESTRATION_ENGINE_VERSION}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar' \
@@ -1094,10 +1094,10 @@ for release_engine_marker in \
         SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING
 done
 for release_engine_build_marker in \
-    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.346}' \
+    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.347}' \
     'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}' \
-    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-9deeda5758b7f04135441a203092dd0308d90b65d25037b62ef4f9361d3cf806}' \
-    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-e250e4a17958216c30c1f5d0d31f7b6418a968d5}' \
+    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-22751db8829767d1ab9caedbca4e29de5260f26cafa677abb6f3ee0ee3c7e6f6}' \
+    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-09eb6950551b65c514786b4a1dee91fcfd8aa43b}' \
     'CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'test "${hazelcast_entry}" = "WEB-INF/lib/hazelcast-5.7.5.jar"'; do
@@ -2146,7 +2146,7 @@ done
 
 jq -e '
   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.528"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.529"
   and (.statements | length) == 51
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2172,7 +2172,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.528 >/dev/null
+    "$vendor_pending_fixture" v1.6.529 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2261,4 +2261,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.528 base=v1.6.460 engine=0.183.346 web_console=1.6.183 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.529 base=v1.6.460 engine=0.183.347 web_console=1.6.184 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'