chen21019 · Oct 15, 2026 · Oct 15, 2026
@@ -1,5 +1,38 @@
 # Compatibility Contract
 
+## Server v1.6.537 prepared, not published
+
+This candidate targets Web Console `1.6.190` and Engine `v0.183.350`.
+Component producer commits and artifact SHA-256 values are pinned in the recipe.
+Server producer, final image identity and official release checks remain pending. See the
+[candidate note](docs/releases/server-1.6.537.md). No Server537 publication or
+deployment is claimed; the Server536 identities below remain historical facts.
+
+Stack and Service `archived` is a persisted boolean with missing values treated
+as false. Archive requires stopped services and instances, rejects system/driver
+resources, and has no start/stop/delete or storage lifecycle side effect. Empty
+Stacks may be archived. Parent and child flags remain independent; restore does
+not clear separately archived children. Archived resources must be restored
+before starting or adding/moving children into them. Archive/restore uses the
+existing update authorization and native v1/v2-beta APIs, not a new role grant.
+Older Engines do not implement archive enforcement; code rollback does not
+promise retained archive behavior and archive never replaces data backups.
+
+The console's personal, per-environment archive switch changes only visibility.
+Read-only users may include archived resources without gaining write controls;
+the effective schema and update capability remain authoritative. Older Engines
+without a readable/updatable boolean field do not offer the action. The modal
+warns that mounts and volumes are retained and require operator backups.
+
+Reviewed pre-release isolated evidence covers focused tests, native role/Key
+archive/restore, thirteen-locale layouts, owner-read Key audit, and separate
+physical workload/mount preservation and first-host checks. It does not establish
+the final537 image or future published190/350 artifact identities. Existing API
+Key policy, authentication/OIDC/MFA, three-volume persistence, CLI defaults,
+performance overrides and firewall contracts are not changed by this feature.
+Security document release IDs advance only; VEX statements, vendor findings and
+their review deadlines are preserved pending the new final-image security gate.
+
 ## Server v1.6.536 published
 
 Immutable Server producer `b8cefb51db7f5e88341fdf231f6ae43d773fb9c7` passed the original official workflow [38681298101](https://github.com/PastureStack/server/actions/runs/38681298101) and anonymous release readback. Manifest: `sha256:84b701244ccd83abc313cfad47c52edf9c58fa49cdd5c2da129cdac0c81d8094`. Distinct OCI config: `sha256:4b56a5f4f58edf2ff08414fde91cc70da440562d7b6264ec62aaca133c256237`. Artifact identity (not an installation command): `ghcr.io/pasturestack/server:v1.6.536@sha256:84b701244ccd83abc313cfad47c52edf9c58fa49cdd5c2da129cdac0c81d8094`. Documentation commits do not replace the producer. Numeric installation tags remain required.

@@ -11,9 +11,15 @@ upstream history, authorship, licenses, and notices.
 
 <a id="current-release"></a>
 
-## Current release
+## Current source candidate
 
-Server [`v1.6.536`](https://github.com/PastureStack/server/releases/tag/v1.6.536) packages unchanged Web Console `1.6.189` and Engine `v0.183.349`, with maintained external CLI `v0.6.18` download defaults. Explicit saved URLs and operator overrides remain authoritative. See the [release note](docs/releases/server-1.6.536.md) for immutable identities, native command evidence and remaining acceptance boundaries. Existing API authorization, OIDC/MFA, registration and performance contracts remain unchanged.
+Server `v1.6.537` is a prepared source candidate, not a published image.
+It targets Web Console `1.6.190` and Engine `v0.183.350` for persistent
+Stack/Service archive and restore. See the [candidate note](docs/releases/server-1.6.537.md)
+for the behavior, isolated acceptance scope, pinned component identities and
+remaining Server publication gates.
+The latest published release remains [Server `v1.6.536`](https://github.com/PastureStack/server/releases/tag/v1.6.536);
+its [release note](docs/releases/server-1.6.536.md) retains the official artifact evidence.
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -39,23 +45,25 @@ Maintained CLI `0.6.18` propagates rejected requests as nonzero errors. Legacy `
 
 ## Quick start
 
-Public GHCR downloads do not require a registry login. Use the released numeric
-tag below and keep all three named volumes:
+Public GHCR downloads do not require a registry login. Keep all three named volumes.
+The examples below target the prepared numeric `v1.6.537` tag; run them only after its official release.
+This candidate is not yet available from GHCR. Until publication, use the latest
+published release identified above.
 
 ```sh
 docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.536
+  ghcr.io/pasturestack/server:v1.6.537
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.536
+    image: ghcr.io/pasturestack/server:v1.6.537
     restart: unless-stopped
     ports:
       - "8080:8080"

@@ -7,6 +7,10 @@ runtime gates have passed.
 
 ## Release notes
 
+- [Server v1.6.537 candidate](releases/server-1.6.537.md) — prepared for Web
+  Console `1.6.190` and Engine `v0.183.350` archive/restore. Component identities
+  are pinned; official Server image/publication gates remain pending.
+
 - [Server v1.6.529](releases/server-1.6.529.md) — published with Engine
   `0.183.347` and Web Console `1.6.184` for subscription terminal audit and its
   translated target label. Official publication and immutable readback passed;

@@ -8,18 +8,20 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses published Server `v1.6.536`, packaging Web Console `1.6.189`
-and Engine `v0.183.349`. See the [release note](../releases/server-1.6.536.md)
-for immutable identities and acceptance limits.
+The example targets prepared Server `v1.6.537`, Web Console `1.6.190` and Engine
+`v0.183.350`; run it only after its official release and image have been published and read back.
+This candidate is not yet available from GHCR. See the
+[candidate note](../releases/server-1.6.537.md) for pinned component identities
+and the bounded pre-release acceptance evidence.
 
 This release retains the same performance-setting contract. Existing runtime
-overrides and volumes must be preserved on upgrade or code rollback. The CLI download-default update does not establish a performance improvement
-or complete broader acceptance.
+overrides and volumes must be preserved on upgrade or code rollback. Archive and
+restore do not establish a performance improvement or complete broader acceptance.
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.536
+    image: ghcr.io/pasturestack/server:v1.6.537
     restart: unless-stopped
     ports:
       - "8080:8080"

@@ -0,0 +1,102 @@
+# Server v1.6.537 candidate
+
+Prepared source only; no Server image or release has been published.
+
+This candidate targets Web Console `1.6.190` and Engine `v0.183.350` for
+Stack/Service archive and restore. It retains the pinned Server460 build base,
+the other component producers, maintained CLI `v0.6.18` defaults, authentication,
+performance settings and the three-volume persistence contract.
+
+## Behavior
+
+`archived` is a server-persisted boolean; missing values mean false. Archive
+requires fully stopped services and associated instances, including sidekicks;
+an empty Stack is allowed. System/infrastructure and driver resources cannot be
+archived. Archive/restore only updates the flag: it does not stop, start, remove
+or recreate containers, mounts or data volumes. Back up retained data separately.
+Parent and child archive flags remain independent. Restore does not clear an
+independently archived child. Restore archived resources before starting them or
+adding/moving children into them; ordinary stop/delete behavior is unchanged.
+New-resource clones omit the archive flag.
+
+The console switch next to sorting is a personal, per-environment visibility
+preference, not a bulk archive command. Counts, archived badges, direct details,
+cross-tab updates, keyboard access, RTL and reduced-motion behavior remain
+explicit. The effective schema and update capability govern write controls;
+older Engines without the field do not offer archive. Native v1/v2-beta writes
+retain the original role and API Key `update` authorization, including live
+owner RBAC and scope limits. Archive writes send only `archived`.
+
+## Reviewed isolated candidate evidence
+
+The following local acceptance receipts concern pre-release feature inputs,
+not the final537 image or the future published190/350 artifact identities:
+
+- `backend-tests.json`: 63 unique focused tests, zero failures/errors/skips.
+- `frontend-tests.json`: 37 unique focused tests; 36 unaffected results are
+  carried forward and the actual compiled RTL stylesheet case was rerun once.
+- `isolated-test.json` and `isolated-adjacent.json`: 31 core native checks plus
+  three adjacent fresh-default/system guards, not a whole-platform suite.
+- `archive-auth-matrix-results.json`: 88 native archive/restore pairs across
+  v1/v2-beta, five roles, two projects and six Key modes; all passed. Separate
+  `archive-role-browser-results.json` covers five actual role views.
+- `archive-browser-results.json`: seven browser interactions and 52 layout
+  groups (13 locales, light/dark, desktop/narrow), including keyboard, preferences,
+  direct details and cross-tab updates. The banner fixture is explicitly an
+  injected HTTP422, not a claim that the same UI test caused a real backend refusal.
+- `archive-audit-only-results.json`: six native appendix checks plus four UI
+  checks distinguish ALLOW/SUCCEEDED/200, DENY/DENIED/403 and ALLOW/FAILED/422.
+  The minting owner reads its personal Key audit. Earlier admin reads of a
+  foreign personal Key correctly returned403 and are not counted as audit PASS.
+- `archive-physical-results.json`: six bounded real-host checks cover first-host
+  registration/default infrastructure, CNI DNS/egress/health, running-service
+  refusal, stopped Service/Stack archive/restore with unchanged runtime/mount
+  fingerprints and bind/named-volume data hashes, and native reactivation of the
+  same instance. `archive-host-lease-restore.json` records restoration of the
+  original host state; no original VM data or volumes were deleted.
+
+These checks do not claim a full preserved-database upgrade, distributed
+multi-node race test, unrelated OIDC/MFA rerun or final release-image validation.
+Formal image health/restart, security scan/SBOM, anonymous asset readback and
+publication remain separate gates. Do not turn these local receipt names into
+published asset claims without attaching their reviewed immutable evidence.
+
+## Component identities and remaining release gates
+
+The recipe pins the following reviewed packager outputs, not previous189/349
+identities. Official component publication/readback must complete before Server
+assembly; the pins alone do not establish a published Server image.
+
+| Input | Pinned value | Locations |
+| --- | --- | --- |
+| `web-console-1.6.190.tar.gz` SHA-256 | `b06612812113fb4b54cf0f2b4754af077406306fd72407e04b17f2ad9f4dc927` | Dockerfile/build defaults, source gate and packaging-test `WEB_SHA` |
+| Web190 producer commit | `9ff823c2233e2041c2f00bb56a91d147a7feaa1d` | Dockerfile/build defaults, source gate and packaging-test `WEB_SOURCE` |
+| Engine350 `cattle.jar` SHA-256 | `637ddaa42cd93c019b4d0813d7053b71dc42797a7f3ac2aa4b10fcc7e304cb31` | Dockerfile/build defaults, source gate and packaging-test `ENGINE_SHA` |
+| Engine350 producer commit | `9c884710e5ea3d4136d80a870d9de9485674f3c3` | Dockerfile/build defaults, source gate and packaging-test `ENGINE_SOURCE` |
+
+The files are `server/Dockerfile.web-compose-release`,
+`server/build-api-explorer-patch-image.sh`,
+`scripts/check-server-api-explorer-patch.sh` and
+`scripts/test-current-server-packaging-contract.py`. The local350 `cattle.jar`
+was independently read back at 87,906,638 bytes with the exact SHA-256 above.
+Its `WEB-INF/lib/cattle-resources-0.183.350.jar` contains `schema/v1/readonly.ser`
+(340,159 bytes, SHA-256 `7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233`)
+and `schema/v1/restricted.ser` (355,023 bytes, SHA-256
+`f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51`).
+These actual reads confirm the retained frozen-schema pins for this artifact.
+Server537 producer commit, manifest/config digests, workflow and publication
+readback are also pending and must be recorded from the actual final outputs.
+
+The existing coordinate predicates continue to reject placeholders. OpenVEX and
+vendor tracking advance their release IDs only: the 69 VEX statements, 11
+vendor-pending CVEs/22 package rows, severities, fix policy and 2026-10-20 review
+deadline are unchanged. This metadata update is not a new scan or remediation;
+the new final-image security gate must still verify the exact current findings.
+
+## Install and rollback boundary
+
+Operational examples use only `ghcr.io/pasturestack/server:v1.6.537`, never a
+digest-qualified or SHA-only installation tag. Run them only after official
+publication and readback. Preserve all three existing named volumes, runtime
+overrides and a working rollback container; do not restore old policy/revocation
+or database state merely to roll back code. See the [upgrade guide](../upgrades/README.md).