Bump version to 6.0.0

- set release version for v6 GA publication
- align Docker defaults and promotion proof with the stable cut

VERSION

@@ -1 +1 @@
-6.0.0-rc.7
+6.0.0

docker-compose.yml

@@ -2,7 +2,7 @@ version: '3.8'
 
 services:
   pulse:
-    image: ${PULSE_IMAGE:-rcourtman/pulse:6.0.0-rc.7}
+    image: ${PULSE_IMAGE:-rcourtman/pulse:6.0.0}
     container_name: pulse
     restart: unless-stopped
     logging:

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -589,7 +589,7 @@ TLS floor in the dynamic config.
    across release notes, upgrade guidance, support policy, promotion records,
    and release-promotion resolver proof before workflow dispatch. For the
    2026-07-02 cutover candidate, that packet is
-   `promoted_from_tag=v6.0.0-rc.7`, `rollback_version=v5.1.34`,
+   `promoted_from_tag=v6.0.0-rc.7`, `rollback_version=v5.1.35`,
    `ga_date=2026-07-02`, and `v5_eos_date=2026-09-30`.
    That stable cut must also move the repo-root Docker compose default and
    `scripts/install-docker.sh` fallback from the final RC image tag to the
@@ -757,6 +757,12 @@ TLS floor in the dynamic config.
 
 ## Current State
 
+The active stable `v6.0.0` cut sets the repo-root `VERSION`, repo-root
+`docker-compose.yml` image default, and `scripts/install-docker.sh` fallback
+to the same `6.0.0` release version. The GA promotion metadata for this cut is
+`promoted_from_tag=v6.0.0-rc.7`, `rollback_version=v5.1.35`,
+`ga_date=2026-07-02`, and `v5_eos_date=2026-09-30`.
+
 The shell-installer boundary carries root-agent service hardening for Linux
 installs. Installer-rendered agent units must keep the health/metrics listener
 loopback by default, allow explicit disablement or network-scrape opt-in
@@ -803,10 +809,10 @@ compose image default and the standalone installer fallback constant. A draft
 release workflow failure caused by stale Docker image pins is a release-packet
 blocker until the defaults, tests, and evidence record are refreshed from the
 new branch head.
-For the active `v6.0.0-rc.7` cut, the repo-root compose default and
-`scripts/install-docker.sh` fallback must both pin `6.0.0-rc.7`; the stable
-promotion guard remains in force by rejecting leftover `-rc.` defaults only
-when the governed `VERSION` is a stable release.
+For the active stable `v6.0.0` cut, the repo-root compose default and
+`scripts/install-docker.sh` fallback must both pin `6.0.0`; the stable
+promotion guard remains in force by rejecting leftover `-rc.` defaults when
+the governed `VERSION` is a stable release.
 The RC7 packet refresh records `fc10de9b5477613316473267b72b05b6b2b7aaff`
 as the current validation-risk commit. That head includes the earlier
 Docker-default correction plus the follow-on capacity-forecast and Patrol

scripts/install-docker.sh

@@ -6,7 +6,7 @@ set -euo pipefail
 
 SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
 DOCKER_IMAGE_REPO="${DOCKER_IMAGE_REPO:-rcourtman/pulse}"
-CANONICAL_DEFAULT_PULSE_VERSION="6.0.0-rc.7"
+CANONICAL_DEFAULT_PULSE_VERSION="6.0.0"
 
 resolve_default_pulse_version() {
     if [ -n "${PULSE_IMAGE_VERSION:-}" ]; then

scripts/installtests/install_docker_sh_test.go

@@ -99,6 +99,9 @@ func TestRepoDockerComposeDefaultPinsCurrentVersion(t *testing.T) {
 	if !isPrereleaseVersion(version) && strings.Contains(text, "-rc.") {
 		t.Fatalf("stable repo docker-compose.yml must not keep a prerelease image default:\n%s", text)
 	}
+	if !isPrereleaseVersion(version) && version == "6.0.0" && !strings.Contains(text, "rcourtman/pulse:6.0.0") {
+		t.Fatalf("v6 GA repo docker-compose.yml must default to the stable v6 image:\n%s", text)
+	}
 	if strings.Contains(text, ":latest") {
 		t.Fatalf("repo docker-compose.yml must not default to a floating latest tag:\n%s", text)
 	}
@@ -118,6 +121,9 @@ func TestInstallDockerScriptFallbackPinsCurrentVersion(t *testing.T) {
 	if !isPrereleaseVersion(version) && strings.Contains(text, `CANONICAL_DEFAULT_PULSE_VERSION="`) && strings.Contains(text, "-rc.") {
 		t.Fatalf("stable install-docker.sh fallback must not keep a prerelease default:\n%s", text)
 	}
+	if !isPrereleaseVersion(version) && version == "6.0.0" && !strings.Contains(text, `CANONICAL_DEFAULT_PULSE_VERSION="6.0.0"`) {
+		t.Fatalf("v6 GA install-docker.sh fallback must default to the stable v6 image tag:\n%s", text)
+	}
 }
 
 func runInstallDockerScript(t *testing.T, workDir string, envVars ...string) {

scripts/release_control/resolve_release_promotion_test.py

@@ -90,25 +90,25 @@ class ResolveReleasePromotionTest(unittest.TestCase):
         release_notes = (REPO_ROOT / "docs/releases/RELEASE_NOTES_v6.md").read_text(encoding="utf-8")
         metadata = resolver.resolve_metadata(
             version="6.0.0",
-            promoted_from_tag_input="v6.0.0-rc.6",
-            rollback_version_input="v5.1.34",
-            ga_date_input="2026-06-04",
-            v5_eos_date_input="2026-09-02",
+            promoted_from_tag_input="v6.0.0-rc.7",
+            rollback_version_input="v5.1.35",
+            ga_date_input="2026-07-02",
+            v5_eos_date_input="2026-09-30",
             hotfix_exception=False,
             hotfix_reason_input="",
             release_notes_input=release_notes,
-            tag_exists_fn=lambda tag: tag in {"v6.0.0-rc.6", "v5.1.34"},
-            tag_commit_fn=lambda tag: "rc6-commit",
-            head_descends_from_fn=lambda commit: commit == "rc6-commit",
+            tag_exists_fn=lambda tag: tag in {"v6.0.0-rc.7", "v5.1.35"},
+            tag_commit_fn=lambda tag: "rc7-commit",
+            head_descends_from_fn=lambda commit: commit == "rc7-commit",
             tag_created_unix_fn=lambda tag: 100,
             now_unix_fn=lambda: 100 + (163 * 3600),
         )
 
-        self.assertEqual(metadata["promoted_from_tag"], "v6.0.0-rc.6")
-        self.assertEqual(metadata["rollback_tag"], "v5.1.34")
-        self.assertEqual(metadata["rollback_command"], "./scripts/install.sh --version v5.1.34")
-        self.assertEqual(metadata["ga_date"], "2026-06-04")
-        self.assertEqual(metadata["v5_eos_date"], "2026-09-02")
+        self.assertEqual(metadata["promoted_from_tag"], "v6.0.0-rc.7")
+        self.assertEqual(metadata["rollback_tag"], "v5.1.35")
+        self.assertEqual(metadata["rollback_command"], "./scripts/install.sh --version v5.1.35")
+        self.assertEqual(metadata["ga_date"], "2026-07-02")
+        self.assertEqual(metadata["v5_eos_date"], "2026-09-30")
 
     def test_stable_hotfix_requires_reason(self) -> None:
         with self.assertRaisesRegex(ValueError, "hotfix_reason is required"):