Refresh RC3 packet for stable installer fix

docs/release-control/v6/internal/records/documentation-currentness-and-legacy-cleanup-rc3-commit-audit-2026-05-03.md

@@ -15,17 +15,18 @@ described the v5.1.29 maintenance ports and current RC issue follow-up. That
 was accurate but under-scoped for the full `rc.2` to `rc.3` delta.
 
 The packet was refreshed again after the later RC3 candidate commits that made
-self-hosted SSO a Community-tier capability and audited SSO provider settings.
+self-hosted SSO a Community-tier capability, audited SSO provider settings,
+and fixed stable installer prerelease selection.
 
 ## Reviewed Range
 
 - From tag: `v6.0.0-rc.2`
 - From commit: `2868b44cf91b59bca85cd886711d78cd3c376fab`
-- To candidate commit: `83f6296c94e91fb53d088d0b53776de518b1389b`
-- Git range: `v6.0.0-rc.2..83f6296c94e91fb53d088d0b53776de518b1389b`
-- Commit count: `601`
+- To candidate commit: `c27814d1901ec59fad510dfb5c57358dfa6525b1`
+- Git range: `v6.0.0-rc.2..c27814d1901ec59fad510dfb5c57358dfa6525b1`
+- Commit count: `603`
 - Date span in the range: `2026-04-16` through `2026-05-03`
-- Changed scope: `1765` files, `113498` insertions, `72686` deletions
+- Changed scope: `1765` files, `113745` insertions, `72725` deletions
 
 ## Review Method
 
@@ -47,11 +48,11 @@ Commands used for the coverage pass:
 
 ## Commit Coverage Summary
 
-The 601 commits were covered by these release-note buckets:
+The 603 commits were covered by these release-note buckets:
 
 - release packaging, release validation, signed assets, installer resolution,
-  update signer continuity, rollback posture, Helm, Docker, and workflow
-  hardening
+  stable-channel prerelease filtering, update signer continuity, rollback
+  posture, Helm, Docker, and workflow hardening
 - security, auth, token handling, setup/bootstrap state, transport validation,
   trusted proxy, websocket origin, workflow permission, webhook, and outbound
   HTTP hardening
@@ -80,17 +81,18 @@ corrective maintenance RC:
 - `docs/releases/V6_CHANGELOG_RC3_DRAFT.md`
   - records the exact commit range and count
   - adds release packaging, security/auth, hosted/mobile, governance, latest
-    storage, skip-auth, SSO entitlement, provider-settings, and
-    artifact-validation coverage
+    storage, skip-auth, SSO entitlement, provider-settings, stable installer
+    selection, and artifact-validation coverage
 - `docs/releases/RELEASE_NOTES_v6_RC3_DRAFT.md`
   - expands the release intent from a narrow corrective RC to a broad
     hardening RC with corrective maintenance at its core
   - adds release packaging, security/auth, hosted/mobile, governance, storage
-    summary, skip-auth, SSO entitlement, provider-settings, and
-    artifact-validation re-test notes
+    summary, skip-auth, SSO entitlement, provider-settings, stable installer
+    selection, and artifact-validation re-test notes
 - `docs/releases/V6_RC3_OPERATOR_SUPPORT_PACK_DRAFT.md`
   - aligns maintainer-facing support language with the broader audited delta
-  - adds the newest storage, skip-auth, SSO, and release-asset validation notes
+  - adds the newest storage, skip-auth, SSO, stable installer selection, and
+    release-asset validation notes
 - `docs/release-control/v6/internal/subsystems/deployment-installability.md`
   - records that post-draft packet changes must carry exact commit coverage,
     artifact/release-pipeline evidence, and a refreshed draft before

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -180,6 +180,9 @@ server-side update execution surfaces.
    new candidate head, including the exact commit count, candidate commit hash,
    changed-scope summary, and any new release-risk themes introduced by those
    commits.
+   Installer-resolution fixes that affect stable versus prerelease selection
+   are one of those release-risk themes and must be named in the current RC
+   packet before the release workflow is restarted.
    The prerelease feedback intake template and active demo/update metadata must
    also stay on generic or current-RC wording instead of hard-coding stale
    `rc.1` examples once later candidates exist.

docs/releases/RELEASE_NOTES_v6_RC3_DRAFT.md

@@ -13,6 +13,8 @@ before broader retesting:
 
 - release artifacts, draft metadata, upload retries, signing, validation, and
   installer resolution should match the current release workflow
+- stable installer resolution should stay on the latest stable semver tag even
+  when GitHub's floating latest release points at an RC
 - auth, token, update, hosted callback, transport, and workflow trust
   boundaries should fail closed where the `rc.2` line was too loose
 - v5-to-v6 installs and updates should avoid avoidable installer, disk-space,
@@ -31,10 +33,10 @@ before broader retesting:
 - the support packet should be explicit about the post-`rc.2` update-signer
   transition and the stable rollback target
 
-This packet was audited against all `601` commits in the current candidate
+This packet was audited against all `603` commits in the current candidate
 range, from
 `2868b44cf91b59bca85cd886711d78cd3c376fab` through
-`83f6296c94e91fb53d088d0b53776de518b1389b`.
+`c27814d1901ec59fad510dfb5c57358dfa6525b1`.
 
 ## Support Stance
 
@@ -86,6 +88,9 @@ range, from
 
 - The stable install path remains anchored to v5.1.29 instead of accidentally
   resolving to a v6 RC from the fresh Proxmox LXC script path.
+- The root installer now filters stable-channel release resolution to stable
+  semver tags and downloads the installer from that stable release asset, so
+  the stable path does not follow an RC-shaped GitHub latest-release redirect.
 - The installer now checks available disk space before stopping the current
   service, so a low-space update should fail before interrupting a working
   install.

docs/releases/V6_CHANGELOG_RC3_DRAFT.md

@@ -24,10 +24,10 @@ The changelog was audited against every commit in the exact release range for
 the current candidate head:
 
 - `v6.0.0-rc.2`: `2868b44cf91b59bca85cd886711d78cd3c376fab`
-- candidate commit: `83f6296c94e91fb53d088d0b53776de518b1389b`
-- range: `v6.0.0-rc.2..83f6296c94e91fb53d088d0b53776de518b1389b`
-- commit count: `601`
-- changed scope: `1765` files, `113498` insertions, `72686` deletions
+- candidate commit: `c27814d1901ec59fad510dfb5c57358dfa6525b1`
+- range: `v6.0.0-rc.2..c27814d1901ec59fad510dfb5c57358dfa6525b1`
+- commit count: `603`
+- changed scope: `1765` files, `113745` insertions, `72725` deletions
 
 Those commits are grouped in this changelog rather than listed one by one. The
 range includes release/install/update work, security and trust-boundary
@@ -53,6 +53,9 @@ The release and installer changes in this candidate include:
   not leave a partially populated RC draft
 - clean VCS metadata inside released container images and release builds
 - Proxmox LXC stable installs do not accidentally fall through to a v6 RC
+- stable installer resolution ignores prerelease-shaped tags and downloads the
+  installer from the latest stable release asset instead of trusting GitHub's
+  floating latest-release redirect when an RC is current
 - low-disk updates fail before stopping the current service
 - installer bundle fallback logic works without relying on a missing external
   helper

docs/releases/V6_RC3_OPERATOR_SUPPORT_PACK_DRAFT.md

@@ -14,6 +14,9 @@ _Draft only. Use this as the working support brief for the planned
   readiness work into the v6 candidate before broader retesting.
 - Self-hosted SSO is included with Community and higher tiers. Do not describe
   SAML or multi-provider SSO as a Pro-only upgrade path for this RC.
+- Stable-channel installer resolution must stay on the latest stable semver
+  tag even if GitHub's floating latest-release redirect currently points at an
+  RC.
 - Systems pinned to the historical `rc.2` update trust root should use a manual
   reinstall or explicit trust migration for later prerelease or GA builds.
 
@@ -83,6 +86,8 @@ Use this cohort breakdown:
 - release artifact validation, draft metadata preservation, upload retries,
   signing, and clean version metadata are hardened for the RC path
 - stable install paths stay on v5.1.29 unless the user explicitly opts into v6
+- stable installer downloads resolve from the latest stable release asset
+  instead of accepting an RC-shaped latest-release redirect
 - installer disk preflight runs before stopping the current service
 - bootstrap-token display uses the supported command path
 - Docker agents in Proxmox LXC keep host identity after restart/recreation

scripts/release_control/render_release_body_test.py

@@ -120,10 +120,11 @@ Old metadata section.
             repo_root / "docs/releases/V6_RC3_OPERATOR_SUPPORT_PACK_DRAFT.md"
         ).read_text(encoding="utf-8")
 
-        self.assertIn("83f6296c94e91fb53d088d0b53776de518b1389b", release_notes)
-        self.assertIn("commit count: `601`", changelog)
+        self.assertIn("c27814d1901ec59fad510dfb5c57358dfa6525b1", release_notes)
+        self.assertIn("commit count: `603`", changelog)
         self.assertIn("broad hardening RC with a corrective maintenance core", changelog)
         self.assertIn("Community-tier capabilities", release_notes)
+        self.assertIn("stable-channel release resolution", release_notes)
         self.assertIn("Release asset uploads use bounded retries", release_notes)
         self.assertIn(
             "release artifact validation, draft metadata preservation, upload retries",