docs: align published Server529 installation and subscription evidence

COMPATIBILITY.md

@@ -1,8 +1,8 @@
 # Compatibility Contract
 
-## Server v1.6.529 source candidate
+## Server v1.6.529 published
 
-The candidate pairs Engine `v0.183.347` with Web Console `1.6.184`.
+This release packages Engine `v0.183.347` and Web Console `1.6.184`.
 Subscription terminal audit retains the first close/failure result, bounded
 delivery retry and exactly-once physical cleanup without restoring authorization.
 The console labels event subscriptions, including completion records without a
@@ -11,9 +11,20 @@ live restricted-Key checks, owner RBAC and audit bounds remain unchanged.
 
 Thirty focused Engine tests and three focused Web unit tests, including actual
 labels in all thirteen production locales, passed at the component level.
-Server publication, immutable image readback, native acceptance and deployment
-remain pending; the published installation pairing below remains `v1.6.528`.
-See the [candidate note](docs/releases/server-1.6.529.md) for exact input identities.
+The immutable producer is `f0a1edd7258b4005c5b9fa205c1b93435f759583`.
+Official workflow [38405824990](https://github.com/PastureStack/server/actions/runs/38405824990)
+and immutable readback passed. The linux/amd64 image has one runtime layer;
+its registry manifest is
+`ghcr.io/pasturestack/server:v1.6.529@sha256:0e85f22039a17d114a0d86cf1b682063695773a09bf1a0c308baf32aa2ed394a`.
+The distinct OCI configuration digest is
+`sha256:00d56e427357b5e3f7517ebbb3ba3def64d022944f3ad2cb8e5ac8295067bdc2`.
+Thirty-six native subscription cases passed with twelve local-MFA actors:
+global admin, owner, member, restricted, readonly and no-access, two per role.
+Full, Closed and global-read Custom admission, client-close audit, owner Custom
+revocation and exact disposable cleanup were verified. Two unaffected passed
+cases were carried, not replayed. No full matrix
+or active-agent lifecycle PASS is inferred. Historical results below keep their
+original release scope. See the [release note](docs/releases/server-1.6.529.md).
 
 ## Server v1.6.528 published
 

README.md

@@ -13,25 +13,27 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-Server [`v1.6.528`](https://github.com/PastureStack/server/releases/tag/v1.6.528)
-packages Web Console `1.6.183` and Orchestration Engine `v0.183.346`.
+Server [`v1.6.529`](https://github.com/PastureStack/server/releases/tag/v1.6.529)
+packages Web Console `1.6.184` and Orchestration Engine `v0.183.347`.
 API Key permissions follow the actual operation and the owner's live authority.
 Authorized compose exports and registered actions can load their exact target
 without granting ordinary read/list access or broader resource scope.
 Stack-scoped Container and Instance Link queries retain live ancestry checks
 and work with MariaDB's default optimizer, including nullable Stack references.
 
-The `v1.6.529` source candidate pairs Engine `v0.183.347` with Web Console
-`1.6.184` for subscription terminal audit and its translated target label.
-Component focused checks are separate from Server publication, native acceptance
-and deployment, which remain pending. See the [candidate note](docs/releases/server-1.6.529.md).
-Installation examples below remain on the published `v1.6.528` image.
+API Key subscriptions retain their first terminal close/failure outcome and
+bounded audit delivery retry without restoring authorization. The console labels
+event subscriptions even when a completion record has no target ID; no resource
+picker or grant capability is added. Official publication and immutable readback
+passed. Thirty-six focused subscription cases passed with two local-MFA accounts
+per tested role, including live revocation and separate handshake/terminal audit.
+This is not acceptance of every resource or operation in the permission matrix.
 
 Registration tokens use dedicated Basic authentication. Native project creation
 preserves the creator's initial membership and default networks. HA database
 exports return a SQL ZIP only after successful, nonempty output; failures clean
 up temporary files without returning command stderr or secrets.
-See the [release note](docs/releases/server-1.6.528.md) for component identities
+See the [release note](docs/releases/server-1.6.529.md) for component identities
 and acceptance limits.
 
 The console supports OIDC, TOTP and passkeys, role-aware resource operations,
@@ -74,15 +76,15 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.528
+  ghcr.io/pasturestack/server:v1.6.529
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.528
+    image: ghcr.io/pasturestack/server:v1.6.529
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/README.md

@@ -7,10 +7,11 @@ runtime gates have passed.
 
 ## Release notes
 
-- [Server v1.6.529](releases/server-1.6.529.md) — source candidate with Engine
+- [Server v1.6.529](releases/server-1.6.529.md) — published with Engine
   `0.183.347` and Web Console `1.6.184` for subscription terminal audit and its
-  translated target label. Server publication, native acceptance and deployment
-  remain pending; use the published `v1.6.528` installation guide below.
+  translated target label. Official publication and immutable readback passed;
+  thirty-six focused native subscription cases passed. Whole-matrix acceptance
+  remains separate.
 
 - [Server v1.6.528](releases/server-1.6.528.md) — published with Engine
   `0.183.346` and unchanged Web Console `1.6.183`; fixes MariaDB Stack-ancestry

docs/api-keys.md

@@ -1,13 +1,12 @@
 # API Keys
 
-This guide describes published Server `v1.6.528`, with Engine `0.183.346`
-and Web Console `1.6.183`. Publication does not mean that every role/resource
+This guide describes published Server `v1.6.529`, with Engine `0.183.347`
+and Web Console `1.6.184`. Publication does not mean that every role/resource
 combination has passed acceptance. Use the published numeric image tag in the
 [installation guide](../README.md#quick-start).
 
-The [Server529 source candidate](releases/server-1.6.529.md) pairs Engine
-`0.183.347` with Web Console `1.6.184` for subscription terminal audit.
-Its Server publication, native acceptance and deployment remain pending.
+Official publication, immutable readback and thirty-six focused native subscription
+cases passed. See the [release note](releases/server-1.6.529.md) for scope and limits.
 
 ## Access and expiry
 
@@ -81,14 +80,19 @@ records, even when an agent schema has no `container` alias. Errors retain the
 existing API status/code/request-id and console handling; no alternate login,
 role override or secret recovery path is introduced.
 
-In the Server529 candidate, subscription close, I/O failure and live authorization
+Subscription close, I/O failure and live authorization
 failure retain the first terminal outcome and bounded audit delivery retry.
 Closed registrations are removed and cannot resume resource-body delivery.
 Only lifecycle metadata is retained for retry, not a token, request or grant;
 client close text and Throwable contents are not logged. The console translates
 the `subscribe` audit target even with an empty target ID. This display label is
 not a selectable policy resource and adds no authority.
 
+Subscription admission keeps its existing synthetic-manager boundary: a
+Project/Stack-only read rule does not grant an unscoped subscribe handshake.
+A Custom global-read grant is still bounded by the owner's permissions and
+restricted-stream live checks. No broader grant is implied by the audit label.
+
 ## Integration and recovery
 
 Delegated Linux streams require Host API `0.38.5`, Node Agent `0.13.28` and

docs/performance/README.md

@@ -8,17 +8,17 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published `v1.6.528` image. See the
-[release note](../releases/server-1.6.528.md) for exact identities and acceptance limits.
+The example uses the published `v1.6.529` image. See the
+[release note](../releases/server-1.6.529.md) for exact identities and acceptance limits.
 
-The [Server529 source candidate](../releases/server-1.6.529.md) does not change
-these settings. Keep the published numeric installation tag until its official
-image publication and readback; candidate startup/restart are not yet verified.
+This release does not change these settings. Official image publication and
+readback passed. The isolated upgrade preserved runtime overrides and volumes;
+startup and one restart both returned HTTP 200/pong.
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.528
+    image: ghcr.io/pasturestack/server:v1.6.529
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/releases/server-1.6.529.md

@@ -1,8 +1,8 @@
 # Server v1.6.529
 
-Prepared source only; no Server image or release has been published.
+Server `v1.6.529` 已完成正式不可變發行與匿名讀回。
 
-本候選組裝 Engine `v0.183.347` 與 Web Console `1.6.184`。
+本版組裝 Engine `v0.183.347` 與 Web Console `1.6.184`。
 Engine 補齊 API Key WebSocket 訂閱的終止稽核：保留首次關閉／失敗原因、
 清除關閉後才完成的註冊，並以既有有界排程重試終止事件傳遞。
 實際資源清理仍只執行一次；重試只保留生命週期 metadata，
@@ -27,14 +27,28 @@ nftables、Compose／HA／runtime 設定與資料庫結構均不修改。
 安全清單只更新本版數字識別，既有 VEX 決策與 vendor-pending 條件不變。
 原歷史 Engine 負控制保留，另加入舊 346 不得冒充 347 的封裝檢查。
 
-## 尚待完成
+## 正式發行與驗收邊界
 
 Engine 與 Web 元件已正式發行並匿名讀回相同 SHA-256 成品。
-Server 來源／封裝、安全／SBOM、必要 CodeQL、正式工作流、不可變映像
-發行與讀回仍須依原有 gates 完成。
-Server 訂閱 native 驗收、啟動／一次重啟與部署尚待驗，不宣稱完整矩陣、
-全角色、active-node 註冊生命週期或公司正式站通過。
-目前安裝文件保持已發布 `v1.6.528` 的數字 tag，不使用候選 digest。
+Server 正常合併 producer：`f0a1edd7258b4005c5b9fa205c1b93435f759583`。
+[原正式工作流 38405824990](https://github.com/PastureStack/server/actions/runs/38405824990)
+已通過來源／封裝、安全／SBOM 與發行 gates；必要 CodeQL 未繞過。
+linux/amd64 成品有一個 runtime layer，不可變 tag 與實際讀回吻合。
+Registry manifest：
+`ghcr.io/pasturestack/server:v1.6.529@sha256:0e85f22039a17d114a0d86cf1b682063695773a09bf1a0c308baf32aa2ed394a`。
+不同的 OCI config：
+`sha256:00d56e427357b5e3f7517ebbb3ba3def64d022944f3ad2cb8e5ac8295067bdc2`。
+
+正式映像的 36 個訂閱子案通過：全域管理者、owner、member、restricted、
+readonly、no-access 各兩個 local-MFA 帳號；涵蓋 Full、Closed、自訂全域唯讀、
+client close、owner 自訂 Key 撤權、HTTP101 與 terminal 分開、requestId 配對及
+單筆終止事件。兩個已通過子案沿用，沒有重跑；專屬容器與三卷已刪除。
+這不是整個角色／資源矩陣、OIDC 或 active-node 生命週期通過。
+Project／Stack 唯讀白名單不會取得 synthetic subscribe 的無範圍握手授權；
+此既有保護未放寬。隔離升級後首次啟動與一次重啟均為 HTTP200／pong；
+原環境變數、三個 named volumes、AppArmor、network 與 restart policy 保留，
+資料庫五表筆數未變，前一版容器與 SQL 備份保留。公司正式站未部署。
+目前安裝文件使用已發布 `v1.6.529` 的數字 tag；immutable digest 只用於發行身分。
 
 ## 升級與回復