fix(release): package RTL onboarding step alignment

COMPATIBILITY.md

@@ -1,6 +1,6 @@
 # Compatibility Contract
 
-## Server v1.6.533 candidate
+## Server v1.6.533 published; RTL visual follow-up required
 
 This candidate packages immutable Web Console `1.6.188`, source
 `8e12216fd6f8d843ed043b4c0afcec995d33caeb`, archive SHA-256
@@ -9,8 +9,15 @@ Native non-bubbling pointer events are owned by the tooltip element lifecycle,
 with run-loop entry and listener cleanup. Existing action-menu overrides and
 static context forwarding are preserved. Four new actual-DOM focused cases
 passed. Engine `v0.183.348`, APIs, registration, authentication, permissions,
-networking and all other component inputs are unchanged. Server publication,
-deployment and 52 actual-browser views plus ordinary HTTP copy remain pending.
+networking and all other component inputs are unchanged. Official publication,
+QA startup and restart passed. Producer: `6ef201a937500f894f8ec0f5a589cb7f796b66c3`.
+Artifact identity, not an installation command:
+`ghcr.io/pasturestack/server:v1.6.533@sha256:f5bc5eb860bec0d6477d03da7e02ee3c683d23c67e9a3d850d36a2a256fb6216`.
+The distinct OCI config is `sha256:011862871af1ac207f3ba72ba68c51e41faf7cfc15527ad9ea321b0d339289e4`.
+All 52 actual-browser clipboard views and ordinary-HTTP copy passed; subsequent
+visual review found the existing RTL step background remained left while its
+number moved right. This is not complete whole-page layout acceptance; the
+alignment repair requires a new immutable component and Server patch.
 See [the release note](docs/releases/server-1.6.533.md).
 
 ## Server v1.6.532 published; browser acceptance incomplete

README.md

@@ -13,51 +13,21 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-Server [`v1.6.532`](https://github.com/PastureStack/server/releases/tag/v1.6.532)
-packages Web Console `1.6.187` and Orchestration Engine `v0.183.348`.
-The console includes scoped clipboard message and feedback changes across all
-13 supported locales; actual-browser acceptance remains incomplete.
-The shared Default uses the configured public Native project template, with
-system-stack definitions available before host registration and service
-activation triggered by the first active host. Machine driver cards display
-each driver's API name, including drivers sharing the generic icon; catalog
-names retain localization and formatting. Personal API Keys are available
-without an accessible environment.
-
-API Key permissions follow the actual operation and the owner's live authority.
-Authorized compose exports and registered actions can load their exact target
-without granting ordinary read/list access or broader resource scope.
-Stack-scoped Container and Instance Link queries retain live ancestry checks
-and work with MariaDB's default optimizer, including nullable Stack references.
-
-Subscription audit retains the first terminal close/failure outcome and bounded
-delivery retry without restoring authorization.
-The console labels event subscriptions even when a completion record has no
-target ID; resource-picker and grant capabilities retain their existing boundaries.
-
-Registration tokens use dedicated Basic authentication. Native project creation
-preserves the creator's initial membership and default networks. HA database
-exports return a SQL ZIP only after successful, nonempty output; failures clean
-up temporary files without returning command stderr or secrets.
-See the [release note](docs/releases/server-1.6.532.md) for component identities
-and acceptance limits.
-
-Official publication, immutable readback and QA 8080 deployment passed, including
-startup and restart checks with preserved volumes and runtime overrides.
-Actual-browser verification found a native hover event-lifecycle defect
-in Web Console `1.6.187`. A new `1.6.188` candidate takes over those repairs;
-the 52 locale/width/theme browser cases remain incomplete.
-
-The console supports OIDC, TOTP and passkeys, role-aware resource operations,
-container resource/hardware settings, and movable terminal/log windows.
-Hardware options require compatible node software and actual host capabilities;
-GPU device access is not exclusive GPU allocation. Audit queries and JSON, CSV
-and XLSX exports preserve environment authorization, explicit date bounds and
-bounded pagination. Query/export errors retain filters and successful query
-results. See the [Host compatibility guide](docs/hosts/README.md) before enrolling
-a host and the [API Key guide](docs/api-keys.md) for policy and audit behavior.
-A packaged feature does not establish that every resource, role or hardware
-combination has been tested.
+Server [`v1.6.533`](https://github.com/PastureStack/server/releases/tag/v1.6.533)
+packages Web Console `1.6.188` and Orchestration Engine `v0.183.348`.
+It repairs native clipboard hover and localized feedback and includes Ubuntu's
+official curl security update. Publication, immutable readback, QA startup and
+restart passed with preserved volumes and runtime settings.
+
+The 52 clipboard locale/width/theme combinations and ordinary-HTTP copy passed.
+Visual review found a separate RTL step-background alignment defect; its fix
+requires a new immutable component and Server patch. This is not complete
+whole-page or broader role/lifecycle acceptance. See the
+[release note](docs/releases/server-1.6.533.md) for identities and evidence.
+
+Personal API Keys remain available without an accessible environment. Existing
+API authorization, registration, OIDC/MFA and performance contracts are retained.
+See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
 ## API Keys
 
@@ -88,15 +58,15 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.532
+  ghcr.io/pasturestack/server:v1.6.533
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.532
+    image: ghcr.io/pasturestack/server:v1.6.533
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/performance/README.md

@@ -8,20 +8,21 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published `v1.6.532` image, packaging Web Console `1.6.187`
-and Engine `v0.183.348`. See the [release note](../releases/server-1.6.532.md)
+The example uses the published `v1.6.533` image, packaging Web Console `1.6.188`
+and Engine `v0.183.348`. See the [release note](../releases/server-1.6.533.md)
 for exact identities and acceptance limits.
 
 This release does not change these settings. Official image publication and
 immutable readback passed. The QA 8080 switch preserved runtime overrides and
 volumes; startup and restart checks passed. A native hover event-lifecycle
-defect remains in Web `1.6.187`, and the 52 actual-browser cases are
-incomplete; the new Web `1.6.188` candidate takes over the browser repairs.
+repair and 52 clipboard combinations passed in Web `1.6.188`. A separate RTL
+step-background alignment defect remains pending; it does not change these
+performance settings or establish a performance benchmark.
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.532
+    image: ghcr.io/pasturestack/server:v1.6.533
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/releases/server-1.6.533.md

@@ -1,4 +1,4 @@
-# Server v1.6.533 candidate
+# Server v1.6.533
 
 本版封裝正式不可變 Web Console `1.6.188`，Engine 維持 `v0.183.348`。
 實際瀏覽器驗收187時發現：Ember5預設不再委派非冒泡的
@@ -19,8 +19,13 @@ Web producer `8e12216fd6f8d843ed043b4c0afcec995d33caeb`；正式tar為
 `3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92`。
 Web必要檢查、正常簽章合併、不可變發布與匿名讀回已完成。
 
-Server正式發行、成品讀回、8080部署、13語系×桌面／窄版×亮／暗色52組
-以及普通HTTP複製仍各自待完成，不將來源測試當成瀏覽器通過。
+Server正式發行、成品讀回與QA部署已完成，首次啟動與重啟通過。
+Producer `6ef201a937500f894f8ec0f5a589cb7f796b66c3`；正式成品識別（非安裝指令）：
+`ghcr.io/pasturestack/server:v1.6.533@sha256:f5bc5eb860bec0d6477d03da7e02ee3c683d23c67e9a3d850d36a2a256fb6216`。
+13語系×桌面／窄版×亮／暗色52組複製與普通HTTP fallback通過，
+頁面錯誤、缺翻譯及非預期資源寫入均0，偏好／呈現／剪貼簿恢復。
+其後視覺複核找到原有RTL步驟背景與數字分離，故不宣稱整頁版面無缺陷；
+修正須新增189／534不可變成品，不覆寫188／533。
 歷史矩陣與KVM待驗維持原狀。
 
 正式成品安全 gate 發現 curl `8.18.0-1ubuntu2.7` 的 `CVE-2026-92392` HIGH。

docs/releases/server-1.6.534.md

@@ -0,0 +1,24 @@
+# Server v1.6.534 candidate
+
+This candidate packages the new immutable Web Console `1.6.189` RTL
+host-onboarding step alignment repair. The step circle and timeline now follow
+their number on the right in RTL output, using the existing RTL compiler.
+LTR geometry, SVGs, copy controls, tooltip lifecycle and API behavior are retained.
+
+Server `v1.6.533` and Web `1.6.188` remain immutable published artifacts. Their
+52 clipboard combinations and ordinary-HTTP copy passed, but subsequent visual
+review found this existing step-background defect. This candidate is a focused
+follow-up, not a replacement of those artifacts or a whole-site retest.
+
+Engine remains `v0.183.348`; other component versions, the official Ubuntu curl
+security backport, all 69 evidence-backed VEX decisions and the exact 20
+vendor-pending MEDIUM findings are retained. See the
+[533 release note](server-1.6.533.md) for the security evidence.
+
+Native acceptance will rerun the four RTL combinations and four LTR controls,
+plus a separate ordinary-HTTP native copy. The unaffected 44 combinations retain
+their immutable 188 evidence. Publication, deployment and the new eight views
+remain pending; historical matrix HOLDs and KVM are not promoted to PASS.
+
+No authentication, authorization, database, HAProxy, networking backend, volume
+or performance-setting change. Preserve the previous working Server as rollback.

scripts/check-server-api-explorer-patch.sh

@@ -526,7 +526,7 @@ require_marker "$release_dockerfile" \
     'ARG BASE_IMAGE=ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403' \
     SERVER_INCREMENTAL_RELEASE_BASE_MISSING
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.533' \
+    'ARG SERVER_RELEASE_TAG=v1.6.534' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -567,16 +567,16 @@ require_marker "$publish_workflow" \
     'bash source/server/artifacts/verify-host-api-package.sh' \
     SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.188' \
+    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.189' \
     SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.188.tar.gz' \
+    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.189.tar.gz' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT_SHA256=3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92' \
+    'ARG WEB_CONSOLE_ARTIFACT_SHA256=1c90e273b7db8ebf9d851a0ae1ec49dc59067b5ee1099ea3886919c1a79ccdfc' \
     SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_COMMIT=8e12216fd6f8d843ed043b4c0afcec995d33caeb' \
+    'ARG WEB_CONSOLE_COMMIT=f30f5e81dd9ee25878c3aff681eed5bb61883453' \
     SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING
 require_marker "$release_dockerfile" \
     "grep -aF 'hostsPage.permissionDenied'" \
@@ -585,16 +585,16 @@ require_marker "$release_dockerfile" \
     '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING
 require_marker "$build_script" \
-    'web_console_commit=${WEB_CONSOLE_COMMIT:-8e12216fd6f8d843ed043b4c0afcec995d33caeb}' \
+    'web_console_commit=${WEB_CONSOLE_COMMIT:-f30f5e81dd9ee25878c3aff681eed5bb61883453}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING
 require_marker "$build_script" \
-    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.188}' \
+    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.189}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.188.tar.gz}' \
+    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.189.tar.gz}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING
 require_marker "$build_script" \
-    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-3467dfb37d7723b9293bc64145603d09ba24799ad726feb89177c9fa38b4ed92}' \
+    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-1c90e273b7db8ebf9d851a0ae1ec49dc59067b5ee1099ea3886919c1a79ccdfc}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING
 require_marker "$release_dockerfile" \
     'ARG CATALOG_SERVICE_VERSION=0.20.13' \
@@ -1059,10 +1059,10 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.533}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.534}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.533}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.534}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
@@ -2158,7 +2158,7 @@ done
 jq -e '
   ["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves
   |   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.533"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.534"
   and (.statements | length) == 69
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2196,7 +2196,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.533 >/dev/null
+    "$vendor_pending_fixture" v1.6.534 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2285,4 +2285,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.533 base=v1.6.460 engine=0.183.348 web_console=1.6.188 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.534 base=v1.6.460 engine=0.183.348 web_console=1.6.189 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'