diff --git a/VERSION b/VERSION
index fc63ac870..39c523754 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-6.3.0-rc.1
+6.3.0-rc.2
diff --git a/deploy/helm/pulse/Chart.yaml b/deploy/helm/pulse/Chart.yaml
index d4065cb2b..bfa7e089d 100644
--- a/deploy/helm/pulse/Chart.yaml
+++ b/deploy/helm/pulse/Chart.yaml
@@ -2,9 +2,9 @@ apiVersion: v2
 name: pulse
 description: Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent.
 type: application
-version: 6.3.0-rc.1
-appVersion: "6.3.0-rc.1"
-icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.3.0-rc.1/docs/images/pulse-logo.svg
+version: 6.3.0-rc.2
+appVersion: "6.3.0-rc.2"
+icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.3.0-rc.2/docs/images/pulse-logo.svg
 keywords:
   - monitoring
   - proxmox
@@ -32,7 +32,7 @@ annotations:
       description: Smoke tests with kind cluster deployment
   artifacthub.io/links: |
     - name: Documentation
-      url: https://github.com/rcourtman/Pulse/blob/v6.3.0-rc.1/docs/KUBERNETES.md
+      url: https://github.com/rcourtman/Pulse/blob/v6.3.0-rc.2/docs/KUBERNETES.md
     - name: Support
       url: https://github.com/rcourtman/Pulse/discussions
   artifacthub.io/maintainers: |
diff --git a/deploy/helm/pulse/README.md b/deploy/helm/pulse/README.md
index 6ab463c8a..7bf4800a9 100644
--- a/deploy/helm/pulse/README.md
+++ b/deploy/helm/pulse/README.md
@@ -1,6 +1,6 @@
 # pulse
 
-![Version: 6.3.0-rc.1](https://img.shields.io/badge/Version-6.3.0--rc.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.3.0-rc.1](https://img.shields.io/badge/AppVersion-6.3.0--rc.1-informational?style=flat-square)
+![Version: 6.3.0-rc.2](https://img.shields.io/badge/Version-6.3.0--rc.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.3.0-rc.2](https://img.shields.io/badge/AppVersion-6.3.0--rc.2-informational?style=flat-square)
 
 Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent.
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 24d28ed1f..49a9d67e3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,7 +2,7 @@ version: '3.8'
 
 services:
   pulse:
-    image: ${PULSE_IMAGE:-rcourtman/pulse:6.3.0-rc.1}
+    image: ${PULSE_IMAGE:-rcourtman/pulse:6.3.0-rc.2}
     container_name: pulse
     restart: unless-stopped
     logging:
diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md
index 327cb4cb5..7f5775d73 100644
--- a/docs/RELEASE_NOTES.md
+++ b/docs/RELEASE_NOTES.md
@@ -6,9 +6,10 @@ Pulse release notes live on GitHub:
 For historical v4 notes that previously lived in this repo, see:
 `docs/releases/RELEASE_NOTES_v4.md`
 
-For the current v6 release candidate packet, see:
-- `docs/releases/RELEASE_NOTES_v6.3.0-rc.1.md`
-- `docs/releases/V6_CHANGELOG_v6.3.0-rc.1.md`
+For the current v6 release candidate packet (the current v6 support release
+candidate packet), see:
+- `docs/releases/RELEASE_NOTES_v6.3.0-rc.2.md`
+- `docs/releases/V6_CHANGELOG_v6.3.0-rc.2.md`
 
 For the current stable v6 packet, see:
 - `docs/releases/RELEASE_NOTES_v6.2.1.md`
diff --git a/docs/UPGRADE_v6.md b/docs/UPGRADE_v6.md
index 1f6052e66..078e5ba26 100644
--- a/docs/UPGRADE_v6.md
+++ b/docs/UPGRADE_v6.md
@@ -4,8 +4,8 @@ This guide covers practical upgrade steps for existing Pulse installs moving to
 
 For the current v6 release candidate packet, see:
 
-- `docs/releases/RELEASE_NOTES_v6.3.0-rc.1.md`
-- `docs/releases/V6_CHANGELOG_v6.3.0-rc.1.md`
+- `docs/releases/RELEASE_NOTES_v6.3.0-rc.2.md`
+- `docs/releases/V6_CHANGELOG_v6.3.0-rc.2.md`
 
 For the current stable v6 packet, see:
 
diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md
index 30e9db67c..3feff9dc4 100644
--- a/docs/release-control/v6/internal/subsystems/deployment-installability.md
+++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md
@@ -1447,21 +1447,23 @@ diagnostics. The same release workflow also executes the generated self-signed
 and custom-CA Windows installer commands through Windows PowerShell 5.1 before
 release assembly, so the first HTTPS fetch is release proof rather than a
 string-shape assertion.
-The active prerelease `v6.3.0-rc.1` cut sets the repo-root `VERSION`,
+The active prerelease `v6.3.0-rc.2` cut sets the repo-root `VERSION`,
 repo-root `docker-compose.yml` image default, `scripts/install-docker.sh`
-fallback, and Helm chart release metadata to the same `6.3.0-rc.1` release
-version. It follows stable `v6.2.1`, opens the 6.3 candidate line, uses
+fallback, and Helm chart release metadata to the same `6.3.0-rc.2` release
+version. It follows stable `v6.2.1`, opens the published 6.3 candidate line, uses
 `rollback_version=v6.2.1`, and keeps stable/latest pointers on `v6.2.1`. This
 candidate establishes the new minor-release packet with durable scoped Patrol
 objectives, validated read-only observers, verified work receipts, agent action
 preflight with stable refusal codes, large-estate response improvements, and
-monitoring correctness fixes. Subscription-backed Patrol turns also bound
-command cleanup after an idle deadline so descendant-held output pipes cannot
-extend the caller-owned stall budget. The changes since `v6.2.1` do not require a
-Pulse Mobile client change and preserve the existing mobile, Relay, onboarding,
-and mobile-facing API contracts, so the server cut is classified
-`no-mobile-impact`; no companion upload or public mobile-store rollout is part
-of this candidate.
+monitoring correctness fixes. The advanced branch also carries the decision-first
+Patrol inbox, first-class Actions workspace, canonical platform-admission
+projection, and bounded concurrent unified-resource hydration. Subscription-backed
+Patrol turns bound command cleanup after an idle deadline so descendant-held
+output pipes cannot extend the caller-owned stall budget. The changes since
+`v6.3.0-rc.1` do not require a Pulse Mobile client change and preserve the
+existing mobile, Relay, onboarding, and mobile-facing API contracts, so the
+server cut is classified `no-mobile-impact`; no companion upload or public
+mobile-store rollout is part of this candidate.
 The prerelease Windows path retains exact-SHA, checksum, and detached-signature
 verification without Authenticode; stable `v6.3.0` restores mandatory SignPath
 signing unless a new version-bound decision is recorded.
@@ -1469,6 +1471,12 @@ This prerelease keeps `rollback_version=v6.2.1`, publishes a versioned
 public GitHub prerelease plus versioned Docker and Helm artifacts, and does not
 move stable/latest install pointers or stable semver aliases.
 
+The preceding `v6.3.0-rc.1` publication attempt was quarantined before the
+GitHub release commit point when its exact private Pro staging run was
+cancelled. No GitHub release or remote git tag remains. Because `main` advanced
+materially after that attempt, the next dispatch uses `v6.3.0-rc.2` rather than
+retargeting the earlier version to a different exact SHA.
+
 The preceding `v6.2.2-rc.2` candidate used the same support-prerelease path and
 rollback target. It added host-local Docker/Podman registry credentials for
 private-image update checks and smartmontools 7.5 `power_mode` object decoding
@@ -1738,8 +1746,8 @@ For the active stable `v6.1.2` cut, the repo-root compose default and
 `scripts/install-docker.sh` fallback must both pin `6.1.2` whenever the
 governed `VERSION` is that stable cut. The stable promotion guard remains in
 force and rejects leftover `-rc.` defaults.
-For the active prerelease `v6.3.0-rc.1` cut, the repo-root compose default and
-`scripts/install-docker.sh` fallback must both pin `6.3.0-rc.1`
+For the active prerelease `v6.3.0-rc.2` cut, the repo-root compose default and
+`scripts/install-docker.sh` fallback must both pin `6.3.0-rc.2`
 until the next governed stable cut moves them forward. Each new release moves
 these two pins together with the repo-root `VERSION` and the Helm chart metadata
 in the same commit; a cut that leaves any of the four on a superseded value is a
diff --git a/docs/releases/RELEASE_NOTES_v6.3.0-rc.1.md b/docs/releases/RELEASE_NOTES_v6.3.0-rc.2.md
similarity index 65%
rename from docs/releases/RELEASE_NOTES_v6.3.0-rc.1.md
rename to docs/releases/RELEASE_NOTES_v6.3.0-rc.2.md
index 6983c50d2..dc88b93b3 100644
--- a/docs/releases/RELEASE_NOTES_v6.3.0-rc.1.md
+++ b/docs/releases/RELEASE_NOTES_v6.3.0-rc.2.md
@@ -1,14 +1,17 @@
-# Pulse v6.3.0-rc.1 Release Notes
+# Pulse v6.3.0-rc.2 Release Notes
 
-`v6.3.0-rc.1` is a release candidate for the next Pulse v6 minor release and
-the first candidate in the 6.3 line. It follows stable `v6.2.1` and introduces
-the Patrol v2 operating model, guarded agent action preflight, large-estate
-response improvements, and monitoring correctness fixes.
+`v6.3.0-rc.2` is a release candidate for the next Pulse v6 minor release and
+the first published candidate in the 6.3 line. An earlier `rc.1` publication
+did not complete, so this cut uses a fresh immutable version for the advanced
+`main` branch. It follows stable
+`v6.2.1` and introduces the Patrol v2 operating model, a first-class Actions
+workspace, guarded agent action preflight, large-estate response improvements,
+and monitoring correctness fixes.
 
 ## Highlights
 
-- Patrol now works from durable outcomes, scoped investigations, and recent
-  verified-work receipts.
+- Patrol guides operators through one ranked decision at a time; Actions now
+  has its own primary review workspace.
 - Read-only observers extend Patrol coverage between full model investigations
   without granting mutation authority.
 - Approved actions gain agent preflight and stable refusal telemetry; large
@@ -22,12 +25,18 @@ response improvements, and monitoring correctness fixes.
   read-only checks, and kept separate from action authority.
 - Verified Patrol work receipts and clearer navigation between findings,
   objectives, attention items, and governed actions.
+- A persistent decision workspace with explicit decision origin, review
+  progress, next-item navigation, and automatic advancement after a decision.
+- A canonical platform-admission facet projected on unified resources so
+  supported onboarding and runtime modes stay consistent across the product.
 - Unified Agent preflight contracts for package updates, package-cache cleanup,
   and Docker lifecycle or update operations.
 - Production security deployment guidance and a focused security-review packet.
 
 ## Improved
 
+- Patrol now works from durable outcomes, scoped investigations, and verified
+  work receipts instead of treating the chat stream as operational state.
 - Patrol investigations preserve objective and resource intent across retries,
   provider interruptions, chat restarts, truncated responses, and retained
   objective runs.
@@ -35,6 +44,14 @@ response improvements, and monitoring correctness fixes.
   canonicalized and validated before Patrol writes or acts on them.
 - Autonomous execution remains bounded by advertised capabilities, explicit
   policy, agent preflight, current target state, and post-action verification.
+- Patrol separates its Inbox, Protection, and Activity modes, removes duplicate
+  counters and generic state, and keeps Assistant focused on explaining the
+  selected item rather than acting as the operations front door.
+- Authenticated startup no longer pulls the full legacy state payload. Unified
+  resource pages load concurrently after the first page and no longer wait for
+  WebSocket hydration before beginning the canonical fetch.
+- Actions and Patrol identify whether a decision originated from a finding,
+  alert, objective, or explicit operator request, making review context clearer.
 - Action refusal telemetry now classifies target changes, prerequisites,
   contract failures, capability limits, policy decisions, and stale plans
   instead of collapsing the new agent reason codes into the catch-all bucket.
@@ -52,6 +69,12 @@ response improvements, and monitoring correctness fixes.
   or unsupported findings and proposals as successful investigation output.
 - Enabling full AI mode or restarting the chat provider now preserves and
   rewires Patrol controls and investigation dependencies.
+- Platform-admission state stays current across tenant changes, reconnects,
+  shell navigation, and canonical resource aggregation.
+- Agent Doctor names the judged credential in verdict evidence, and agents
+  warn when the server overrides a presented agent identity.
+- Alert threshold overrides resolve through canonical registry identity, and
+  the monitoring-policy menu no longer clips inside alert cards.
 - Docker health-check dependencies and app-container scope now remain attached
   to the correct canonical findings.
 - Stale ZFS alerts clear when storage loses its pool attachment, and node-local
@@ -72,7 +95,7 @@ response improvements, and monitoring correctness fixes.
 
 ## Upgrade Notes
 
-Use the normal v6 install or update flow for `v6.3.0-rc.1` only when you are
+Use the normal v6 install or update flow for `v6.3.0-rc.2` only when you are
 comfortable testing a release candidate. The rollback target is `v6.2.1`.
 
 The exact rollback reinstall command is:
@@ -81,8 +104,8 @@ The exact rollback reinstall command is:
 ./scripts/install.sh --version v6.2.1
 ```
 
-The changes since `v6.2.1` do not require a Pulse Mobile client change and
-preserve the existing mobile, Relay, onboarding, and mobile-facing API
+The changes since `v6.3.0-rc.1` do not require a Pulse Mobile client change
+and preserve the existing mobile, Relay, onboarding, and mobile-facing API
 contracts. No companion mobile build upload or public mobile-store rollout is
 part of this candidate.
 
diff --git a/docs/releases/V6_CHANGELOG_v6.3.0-rc.1.md b/docs/releases/V6_CHANGELOG_v6.3.0-rc.2.md
similarity index 66%
rename from docs/releases/V6_CHANGELOG_v6.3.0-rc.1.md
rename to docs/releases/V6_CHANGELOG_v6.3.0-rc.2.md
index 93eda24c5..16c965357 100644
--- a/docs/releases/V6_CHANGELOG_v6.3.0-rc.1.md
+++ b/docs/releases/V6_CHANGELOG_v6.3.0-rc.2.md
@@ -1,12 +1,16 @@
-# Pulse v6.3.0-rc.1
+# Pulse v6.3.0-rc.2
 
-_This changelog describes the changes since `v6.2.1`.
-`v6.3.0-rc.1` is a prerelease and rolls back to stable `v6.2.1`._
+_This changelog describes the changes since `v6.3.0-rc.1` and carries forward
+the complete cumulative 6.3 packet since stable `v6.2.1`. `v6.3.0-rc.2` is a
+prerelease and rolls back to stable `v6.2.1`._
 
 ## Added
 
 - Durable, scoped Patrol objectives and validated read-only observer missions.
-- Patrol objective, recent-work receipt, and expanded attention interfaces.
+- A decision-first Patrol inbox with ranked review, progress, navigation,
+  Protection, Activity, and recent-work receipt interfaces.
+- A primary Actions workspace for approvals, governed plans, and action records.
+- Canonical platform-admission facts on unified resources.
 - Typed Unified Agent action preflight for supported host and Docker operations.
 - Stable pre-mutation refusal codes and fleet telemetry buckets for target
   changes, prerequisites, contract failures, capability limits, policy, and
@@ -17,10 +21,17 @@ _This changelog describes the changes since `v6.2.1`.
 
 - Patrol is organized around operator outcomes, quiet background observation,
   scoped evidence, typed proposals, governed execution, and verified receipts.
+- Patrol reviews one decision at a time and preserves the selected context
+  across its inbox-and-context desktop workspace and mobile master/detail flow.
+- Assistant explains the selected operational item while Actions owns approval
+  and action-record review as a separate primary workspace.
 - Finding and investigation lifecycles are idempotent, scope-aware, and bounded
   across continuation, provider-failure, restart, and truncation recovery.
 - API responses support gzip, the client WebSocket ceiling is 32 MiB, and
   large-estate polling and resource correlation use bounded or indexed paths.
+- Authenticated startup avoids the legacy full-state pull, starts canonical
+  resource fetching without a WebSocket hydration dependency, and loads later
+  unified-resource pages concurrently.
 - Runtime version identity is bound to the packaged binary rather than a stale
   source-tree value.
 - Buffered subscription CLI turns cannot extend a caller-owned idle deadline
@@ -32,6 +43,11 @@ _This changelog describes the changes since `v6.2.1`.
   resource scope, tool authority, or conclusion is incoherent.
 - Full-mode activation and in-process provider restarts preserve Patrol runtime
   wiring and controls.
+- Platform-admission state remains current across resource projections, tenant
+  changes, reconnects, and shell navigation.
+- Alert monitoring menus no longer clip, threshold overrides use canonical
+  registry identity, Agent Doctor names the credential it judged, and agents
+  surface server-side identity overrides.
 - Docker health findings retain health-check dependencies and selected workload
   scope through investigation and remediation.
 - ZFS storage attachment, vSphere backup presentation, thermal history, cluster
@@ -50,7 +66,7 @@ _This changelog describes the changes since `v6.2.1`.
 
 ## Release Metadata
 
-- Version: `v6.3.0-rc.1`
+- Version: `v6.3.0-rc.2`
 - Previous release: `v6.2.1`
 - Previous stable: `v6.2.1`
 - Rollback target: `v6.2.1`
@@ -60,6 +76,6 @@ _This changelog describes the changes since `v6.2.1`.
 - Windows signing decision: the standing prerelease path publishes exact-SHA,
   checksum, and detached-signature verified Windows agents without
   Authenticode; stable `v6.3.0` restores mandatory SignPath signing
-- Mobile decision: `no-mobile-impact`; changes since `v6.2.1` preserve the
+- Mobile decision: `no-mobile-impact`; changes since `v6.3.0-rc.1` preserve the
   existing mobile, Relay, onboarding, and mobile-facing API contracts, and no
   companion upload or public store rollout is required
diff --git a/frontend-modern/public/docs/UPGRADE_v6.md b/frontend-modern/public/docs/UPGRADE_v6.md
index 1f6052e66..078e5ba26 100644
--- a/frontend-modern/public/docs/UPGRADE_v6.md
+++ b/frontend-modern/public/docs/UPGRADE_v6.md
@@ -4,8 +4,8 @@ This guide covers practical upgrade steps for existing Pulse installs moving to
 
 For the current v6 release candidate packet, see:
 
-- `docs/releases/RELEASE_NOTES_v6.3.0-rc.1.md`
-- `docs/releases/V6_CHANGELOG_v6.3.0-rc.1.md`
+- `docs/releases/RELEASE_NOTES_v6.3.0-rc.2.md`
+- `docs/releases/V6_CHANGELOG_v6.3.0-rc.2.md`
 
 For the current stable v6 packet, see:
 
diff --git a/scripts/install-docker.sh b/scripts/install-docker.sh
index 8479563a4..f7854784e 100755
--- a/scripts/install-docker.sh
+++ b/scripts/install-docker.sh
@@ -6,7 +6,7 @@ set -euo pipefail
 
 SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
 DOCKER_IMAGE_REPO="${DOCKER_IMAGE_REPO:-rcourtman/pulse}"
-CANONICAL_DEFAULT_PULSE_VERSION="6.3.0-rc.1"
+CANONICAL_DEFAULT_PULSE_VERSION="6.3.0-rc.2"
 
 resolve_default_pulse_version() {
     if [ -n "${PULSE_IMAGE_VERSION:-}" ]; then
diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go
index e48cea9c0..ffa25b4a0 100644
--- a/scripts/installtests/build_release_assets_test.go
+++ b/scripts/installtests/build_release_assets_test.go
@@ -655,6 +655,7 @@ func TestCurrentPrereleasePacketTracksInstallMetadata(t *testing.T) {
 		"stable `v"+previous+"`",
 		"Patrol now works from durable outcomes, scoped investigations",
 		"Read-only observers extend Patrol coverage between full model investigations",
+		"Actions and Patrol identify whether a decision originated from a finding, alert, objective, or explicit operator request",
 		"Action refusal telemetry now classifies target changes, prerequisites, contract failures",
 		"Subscription-backed turns now complete their idle timeout promptly",
 		"The rollback target is `v"+previous+"`",
@@ -671,6 +672,7 @@ func TestCurrentPrereleasePacketTracksInstallMetadata(t *testing.T) {
 		"Promotion path: exact-SHA single-build release candidate from `main`",
 		"This changelog describes the changes since `v"+comparisonVersion+"`",
 		"Durable, scoped Patrol objectives and validated read-only observer missions",
+		"A primary Actions workspace for approvals, governed plans, and action records",
 		"Typed Unified Agent action preflight for supported host and Docker operations",
 		"Stable pre-mutation refusal codes and fleet telemetry buckets",
 		"Windows signing decision: the standing prerelease path publishes exact-SHA, checksum, and detached-signature verified Windows agents without Authenticode; stable `v"+stableTarget+"` restores mandatory SignPath signing",
diff --git a/scripts/installtests/install_docker_sh_test.go b/scripts/installtests/install_docker_sh_test.go
index 20c5e09d1..9cbdfb4ee 100644
--- a/scripts/installtests/install_docker_sh_test.go
+++ b/scripts/installtests/install_docker_sh_test.go
@@ -140,6 +140,7 @@ func TestPreviousStableForPrereleaseVersionCrossesMinorBoundaries(t *testing.T)
 		{version: "6.2.2-rc.2", want: "6.2.1"},
 		{version: "6.2.2-rc.3", want: "6.2.1"},
 		{version: "6.3.0-rc.1", want: "6.2.1"},
+		{version: "6.3.0-rc.2", want: "6.2.1"},
 	}
 
 	for _, test := range tests {