Prepare v6.4.1 stable patch

docs/RELEASE_NOTES.md

@@ -7,10 +7,14 @@ For historical v4 notes that previously lived in this repo, see:
 `docs/releases/RELEASE_NOTES_v4.md`
 
 For the current stable v6 packet, see:
+- `docs/releases/RELEASE_NOTES_v6.4.1.md`
+- `docs/releases/V6_CHANGELOG_v6.4.1.md`
+
+For the preceding stable v6 packet, see:
 - `docs/releases/RELEASE_NOTES_v6.4.0.md`
 - `docs/releases/V6_CHANGELOG_v6.4.0.md`
 
-For the preceding stable v6 packet, see:
+For the earlier stable v6 packet, see:
 - `docs/releases/RELEASE_NOTES_v6.3.2.md`
 - `docs/releases/V6_CHANGELOG_v6.3.2.md`
 

docs/UPGRADE_v6.md

@@ -4,10 +4,15 @@ This guide covers practical upgrade steps for existing Pulse installs moving to
 
 For the current stable v6 packet, see:
 
+- `docs/releases/RELEASE_NOTES_v6.4.1.md`
+- `docs/releases/V6_CHANGELOG_v6.4.1.md`
+
+For the preceding stable v6 packet, see:
+
 - `docs/releases/RELEASE_NOTES_v6.4.0.md`
 - `docs/releases/V6_CHANGELOG_v6.4.0.md`
 
-For the preceding stable v6 packet, see:
+For the earlier stable v6 packet, see:
 
 - `docs/releases/RELEASE_NOTES_v6.3.2.md`
 - `docs/releases/V6_CHANGELOG_v6.3.2.md`

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -2145,6 +2145,20 @@ version. It opened the `v6.4.0` candidate line from `main` with
 `rollback_version=v6.3.1` and did not move stable/latest install pointers or
 stable semver aliases.
 
+The active stable `v6.4.1` cut sets the repo-root `VERSION`, repo-root
+`docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and
+Helm chart release metadata to the same `6.4.1` release version. This patch
+release uses the stable hotfix path with `rollback_version=v6.4.0`,
+`hotfix_exception=true`, a release-owner reason, and no fabricated same-version
+RC tag. The active customer harm is the published `v6.4.0` server image's
+non-executable embedded Unified Agent, which breaks Helm agent workloads and
+direct agent entrypoints. The exact pushed `main` SHA must pass the integrated
+candidate checks before publication, including the new pre-publication image
+mode proof. No governed mobile-facing path changed from `v6.4.0`, so the
+release decision is `no-mobile-impact`. The standing SignPath-unavailable
+policy from `v6.3.2` onward still applies, with Public Unknown Publisher
+disclosure and the existing signed integrity controls.
+
 The preceding stable `v6.3.2` cut set the repo-root `VERSION`, repo-root
 `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and
 Helm chart release metadata to the same `6.3.2` release version. This patch
@@ -2569,13 +2583,15 @@ For the active stable `v6.1.2` cut, the repo-root compose default and
 `scripts/install-docker.sh` fallback must both pin `6.1.2` whenever the
 governed `VERSION` is that stable cut. The stable promotion guard remains in
 force and rejects leftover `-rc.` defaults.
-For the active stable `v6.4.0` cut, the repo-root compose default and
-`scripts/install-docker.sh` fallback must both pin `6.4.0` until the next
+For the active stable `v6.4.1` cut, the repo-root compose default and
+`scripts/install-docker.sh` fallback must both pin `6.4.1` until the next
 governed release moves them forward. The stable promotion guard remains in
 force and rejects leftover `-rc.` defaults. Each new release moves
 these two pins together with the repo-root `VERSION` and the Helm chart metadata
 in the same commit; a cut that leaves any of the four on a superseded value is a
 release-packet blocker.
+For the preceding stable `v6.4.0` cut, the repo-root compose default and
+`scripts/install-docker.sh` fallback both pinned `6.4.0`.
 For the preceding stable `v6.3.2` cut, the repo-root compose default and
 `scripts/install-docker.sh` fallback both pinned `6.3.2`.
 For the preceding stable `v6.3.1` cut, the repo-root compose default and

docs/releases/RELEASE_NOTES_v6.4.1.md

@@ -0,0 +1,19 @@
+# Pulse v6.4.1 Release Notes
+
+`v6.4.1` is a stable patch release for the Pulse v6 line. It follows stable
+`v6.4.0` and restores the embedded container agent while correcting first-load
+Proxmox details and several persistence and AI budget edge cases.
+
+## What's improved
+
+- **Container agents start correctly** - The embedded Unified Agent is executable in the server image, restoring Helm deployments with `agent.enabled=true` and direct agent entrypoints.
+- **Proxmox details are correct on first load** - VM and LXC backup status, uptime, and related guest details no longer appear missing until a later live update arrives.
+- **Credential changes fail safely** - Token creation, migration, runtime preparation, and first-run reset restore prior live state when durable persistence fails.
+- **AI budgets cover current models** - Anthropic Sonnet 5, Fable 5, and Mythos 5 usage remains accurately priced and enforceable in Assistant and Patrol summaries.
+
+## Before you upgrade
+
+- Existing configurations remain valid and no manual data migration is required.
+- Pulse Mobile remains compatible. This patch does not require a companion mobile release.
+- Windows Unified Agent binaries are not Authenticode-signed while SignPath remains unavailable and may show an Unknown Publisher warning. Verify downloads with the published checksums and detached signatures.
+- The rollback target is stable `v6.4.0`. On systemd and Proxmox LXC installs, use `sudo /bin/update --version v6.4.0` to return to the previous stable release. For Docker Compose, pin `rcourtman/pulse:6.4.0` and recreate the container.

docs/releases/V6_CHANGELOG_v6.4.1.md

@@ -0,0 +1,47 @@
+# Pulse v6.4.1
+
+_This changelog describes stable `v6.4.1` compared with stable `v6.4.0`._
+
+## Changed
+
+- Anthropic cost accounting recognizes current Sonnet 5, Fable 5, and Mythos
+  5 model identifiers before broad family fallbacks so budget summaries remain
+  enforceable in both overestimate and unknown-price cases.
+- Release qualification verifies executable mode on the embedded Unified Agent
+  and non-executable mode on detached signature sidecars before publication.
+- Published releases remain immutable when a later validation event reports a
+  problem. Remediation moves forward through an explicit patch release.
+
+## Fixed
+
+- The prebuilt server image restores executable mode on copied Unified Agent
+  payloads, so `/usr/local/bin/pulse-agent` works for Helm agent workloads and
+  direct container entrypoints ([#1795](https://github.com/rcourtman/Pulse/issues/1795)).
+- Proxmox VM and LXC REST resources preserve source-authored backup, uptime, and
+  guest metadata on first paint instead of waiting for a WebSocket update
+  ([#1792](https://github.com/rcourtman/Pulse/issues/1792)).
+- API token creation, whole-inventory regeneration, migration, and container
+  runtime preparation restore complete prior live state when persistence fails.
+- First-run credential reset no longer commits a password change when the
+  paired API token update cannot be persisted.
+- Stable rollback guidance uses the installed `/bin/update` helper instead of
+  referring to a repository-relative script that may not exist on the server.
+
+## Release Metadata
+
+- Version: `v6.4.1`
+- Previous stable: `v6.4.0`
+- Rollback target: `v6.4.0`
+- Rollback command: `sudo /bin/update --version v6.4.0`
+- Promotion path: emergency stable patch from `main`, using the single-build
+  release workflow after exact-SHA qualification
+- Emergency reason: the `v6.4.0` server image cannot execute its embedded
+  Unified Agent, which breaks Helm agent workloads and direct container-agent
+  entrypoints on the current stable release
+- Windows signing decision: the standing SignPath-unavailable policy publishes
+  unsigned Windows Unified Agent binaries. They may display an Unknown
+  Publisher warning while exact-SHA candidate binding, checksums, detached
+  signatures, immutable-manifest verification, and published-digest
+  verification remain mandatory
+- Mobile decision: `no-mobile-impact`. No governed mobile-facing path changed
+  from `v6.4.0`, so no companion build or public store rollout is required