docs: align published 1.6.564 installation and qualification

COMPATIBILITY.md

@@ -1,16 +1,34 @@
 # Compatibility Contract
 
-## Server v1.6.564 source candidate
+<a id="server-v16564-publication"></a>
 
-Not yet published. Installation examples remain on published Server563.
-The candidate consumes original published Engine365 / Web204. Optional bridge
+## Server v1.6.564 published
+
+[Server v1.6.564](https://github.com/PastureStack/server/releases/tag/v1.6.564)
+was published by the original
+[publisher 41317439519](https://github.com/PastureStack/server/actions/runs/41317439519).
+All 35 public assets and the OCI digest passed anonymous verification; native
+image provenance and SBOM attestations passed.
+
+| Evidence | Verified value |
+|---|---|
+| Immutable publication identity | `ghcr.io/pasturestack/server:v1.6.564@sha256:884c94832cc507b25585437002dc49c7312d122ee527bb6ff941744c86705213` |
+| Runtime producer | `0ce4a6fdfc00ceba8fc71bcd78af9148454f3bad` |
+| Designated 8080 runtime | Exact published identity, cutover, one real restart and smoke passed; three active Hosts and three active Agents. Production site unchanged. |
+
+The image consumes original published Engine365 / Web204. Optional bridge
 0.2.6 shares the Web producer and is not a second Server runtime. Exact private
 volume/pool cleanup, safe native validation status/code and Catalog wire
 compatibility are corrected. Web admission guidance retains submitted-apply
 UNKNOWN/context/ACK protection. Current actor/role/Key/revision, explicit DENY,
 human confirmation and CAS remain required. Other pins, VEX statements and
-vendor decisions are retained. Matching Server/native acceptance is pending.
-See [candidate coordinates](docs/releases/server-1.6.564.md).
+vendor decisions are retained. Ten registered Medium occurrences remain;
+browser runtime SBOM coverage remains incomplete.
+
+The designated runtime result covers release identity, restart and health.
+Native business workflows and full 243-group WebMCP acceptance remain pending;
+component CI and runtime health do not complete that matrix. Four AI opt-ins
+remain independently default-off. See the [release note](docs/releases/server-1.6.564.md).
 
 
 <a id="server-v16563-publication"></a>

README.md

@@ -13,25 +13,27 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-[Server `v1.6.563`](https://github.com/PastureStack/server/releases/tag/v1.6.563)
-packages Engine `v0.183.364`, Web Console `1.6.203` / optional bridge `0.2.5`,
-Catalog `0.20.17` and Compose `0.14.40`. Engine364 corrects authorized native
-private-image cleanup during standalone container DELETE and stale hostname-map
-cleanup during External target replacement. The exact private graph, current
-actor/role/Key revision/expiry and every explicit DENY remain required.
+[Server `v1.6.564`](https://github.com/PastureStack/server/releases/tag/v1.6.564)
+packages Engine `v0.183.365`, Web Console `1.6.204` / optional bridge `0.2.6`,
+Catalog `0.20.17` and Compose `0.14.40`. Engine365 corrects verified private
+OS-volume/pool cleanup, safe native validation status/code propagation and
+Catalog private-wire compatibility. Web204 improves safe admission guidance
+while preserving context, ACK and submitted-apply UNKNOWN protections. Current
+owner/role/Key revision/expiry and every explicit DENY remain required.
 
 External before-value previews, ServiceIndex cleanup ownership, restricted-Key
 discovery, clear sanitized permission guidance and review/footer layout fixes
 are retained. Official MariaDB JDBC `3.5.11`, Full/legacy behavior, operator
 contracts and four independent default-off AI opt-ins remain. See the
-[release note](docs/releases/server-1.6.563.md) and
-[publication record](COMPATIBILITY.md#server-v16563-publication).
+[release note](docs/releases/server-1.6.564.md) and
+[publication record](COMPATIBILITY.md#server-v16564-publication).
 
 | Qualification | Current evidence |
 |---|---|
 | Publication | Original publisher gates passed; all 35 public assets and the OCI digest passed anonymous verification, with native provenance and SBOM attestations. |
-| Engine component | Original CI passed 3,872 tests in 416 suites: zero failures/errors and one existing skip. Fourteen new cleanup/lifecycle methods and the inherited preview/Index methods are recorded separately. |
-| Designated runtime and business acceptance | Server563 cutover/restart, Core, External, Certificate, Audit and B3 workflows, including role/Key/cross-ID/layout and JDBC compatibility, remain separate pending results. Publication and publisher smoke do not establish full 243-group acceptance. |
+| Engine component | Original CI passed 3,891 tests in 418 suites: zero failures/errors and one existing skip. Nineteen new methods and inherited coverage are recorded separately. |
+| Designated 8080 runtime | Published identity, cutover, one real restart and smoke passed; three Hosts and three Agents are active. The production site was unchanged. |
+| Business acceptance | Native workflows, role/Key/cross-ID, cleanup, layout and weak-model acceptance remain separately tracked. Runtime health does not establish full 243-group WebMCP acceptance. |
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -64,7 +66,7 @@ instance count. Advanced forms and other resource workflows remain pending.
 The complete scoped lifecycle workflow remains unaccepted; review
 the [current limitation](docs/ai-collaboration.md#workload-retirement-limitation)
 before enabling these optional changes.
-See the [release note](docs/releases/server-1.6.563.md) and
+See the [release note](docs/releases/server-1.6.564.md) and
 [AI collaboration guide](docs/ai-collaboration.md) for activation,
 supported operations, audit records and rollback.
 
@@ -78,15 +80,15 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.563
+  ghcr.io/pasturestack/server:v1.6.564
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.563
+    image: ghcr.io/pasturestack/server:v1.6.564
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/performance/README.md

@@ -8,9 +8,9 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published Server `v1.6.563` numeric tag.
+The example uses the published Server `v1.6.564` numeric tag.
 The image and its release assets have passed public identity and checksum readback.
-See the [release note](../releases/server-1.6.563.md) and the
+See the [release note](../releases/server-1.6.564.md) and the
 [current release](../../README.md#current-release) for component versions and
 release details. Preserve the existing runtime overrides and all three named
 volumes during an upgrade or restart.
@@ -21,7 +21,7 @@ evidence is not a performance benchmark; measure the actual workload.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.563
+    image: ghcr.io/pasturestack/server:v1.6.564
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/releases/server-1.6.564.md

@@ -1,7 +1,17 @@
-# Server v1.6.564 candidate
+# Server v1.6.564
 
-Source candidate; not a published image. Installation remains on published563.
-Matching Server publication/restart/business acceptance is pending.
+[Server v1.6.564](https://github.com/PastureStack/server/releases/tag/v1.6.564)
+is published and deployed to the designated 8080 environment. Its exact release
+identity, cutover, one real restart and smoke passed, with three active Hosts
+and three active Agents. The production site was unchanged. Native business
+acceptance remains separate.
+
+| Publication evidence | Verified value |
+|---|---|
+| Immutable publication identity | `ghcr.io/pasturestack/server:v1.6.564@sha256:884c94832cc507b25585437002dc49c7312d122ee527bb6ff941744c86705213` |
+| Runtime producer | `0ce4a6fdfc00ceba8fc71bcd78af9148454f3bad` |
+| Original publisher | [41317439519](https://github.com/PastureStack/server/actions/runs/41317439519) |
+| Public verification | All 35 assets and the OCI digest passed anonymous verification; native provenance and SBOM attestations passed. |
 
 Engine365 corrects the verified standalone private OS-volume/pool cleanup graph,
 safe native validation status/code propagation and bounded single-Base64 Catalog
@@ -28,9 +38,12 @@ Prior Web203 restricted-Key/human-review/footer layout behavior is inherited.
 - All12 Engine and13 Web assets passed actual anonymous SHA/length readback against exact public metadata. Web archive provenance and runtime-SBOM attestations passed. No native Engine SLSA attestation is inferred.
 
 Catalog0.20.17 / Compose0.14.40 and other pins/base image, VEX statements and
-vendor decisions remain unchanged. Source preparation rebuilds no component.
-The original Server publisher must pass its source/build/restart/merged-image
-and browser scans/native attestation gates. Core, External/Alias, Member,
-Catalog, roles/Keys/cross-ID, cleanup and weak-model runtime remain pending.
-Four AI opt-ins remain independently default-off. Server563 results do not
-become Server564 PASS. Full243 coverage is incomplete.
+vendor decisions remain unchanged. The original Server publisher passed its
+source/build/restart, merged-image and browser security gates. Ten registered
+Medium occurrences remain, and browser runtime SBOM coverage remains incomplete.
+Documentation does not change the runtime producer or published bytes.
+
+The designated deployment receipt covers release identity, restart and health
+only. Core, External/Alias, Member, Catalog, role/Key/cross-ID, cleanup, layout
+and weak-model business acceptance remain separately tracked. Four AI opt-ins
+remain independently default-off. Full 243-group WebMCP coverage is incomplete.