diff --git a/VERSION b/VERSION
index ee4f7b374..4c8e522aa 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-6.0.0-rc.3
+6.0.0-rc.4
diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md
index 1addd203a..af9f606b6 100644
--- a/docs/RELEASE_NOTES.md
+++ b/docs/RELEASE_NOTES.md
@@ -16,7 +16,12 @@ For the historical shipped v6 `rc.1` packet, see:
 - `docs/releases/V6_CHANGELOG_RC1.md`
 - `docs/releases/V6_RC_OPERATOR_SUPPORT_PACK.md`
 
-For the current in-repo v6 `rc.3` draft packet, see:
+For the current in-repo v6 `rc.4` draft packet, see:
+- `docs/releases/RELEASE_NOTES_v6_RC4_DRAFT.md`
+- `docs/releases/V6_CHANGELOG_RC4_DRAFT.md`
+- `docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md`
+
+For the historical in-repo v6 `rc.3` draft packet, see:
 - `docs/releases/RELEASE_NOTES_v6_RC3_DRAFT.md`
 - `docs/releases/V6_CHANGELOG_RC3_DRAFT.md`
 - `docs/releases/V6_RC3_OPERATOR_SUPPORT_PACK_DRAFT.md`
diff --git a/docs/UPGRADE_v6.md b/docs/UPGRADE_v6.md
index cb6920336..32136bfcd 100644
--- a/docs/UPGRADE_v6.md
+++ b/docs/UPGRADE_v6.md
@@ -9,9 +9,9 @@ For current stable release notes and rollout references, see:
 
 For the current v6 prerelease packet, see:
 
-- `docs/releases/RELEASE_NOTES_v6_RC3_DRAFT.md`
-- `docs/releases/V6_CHANGELOG_RC3_DRAFT.md`
-- `docs/releases/V6_RC3_OPERATOR_SUPPORT_PACK_DRAFT.md`
+- `docs/releases/RELEASE_NOTES_v6_RC4_DRAFT.md`
+- `docs/releases/V6_CHANGELOG_RC4_DRAFT.md`
+- `docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md`
 
 ## Before You Upgrade
 
diff --git a/docs/release-control/v6/internal/records/documentation-currentness-and-legacy-cleanup-v6-rc4-packet-2026-05-05.md b/docs/release-control/v6/internal/records/documentation-currentness-and-legacy-cleanup-v6-rc4-packet-2026-05-05.md
new file mode 100644
index 000000000..30f132d8c
--- /dev/null
+++ b/docs/release-control/v6/internal/records/documentation-currentness-and-legacy-cleanup-v6-rc4-packet-2026-05-05.md
@@ -0,0 +1,114 @@
+# Documentation Currentness And Legacy Cleanup v6 RC4 Packet Record
+
+- Date: `2026-05-05`
+- Gate: `documentation-currentness-and-legacy-cleanup`
+- Scope:
+  - `pulse`
+  - lane `L9`
+
+## Context
+
+Before publishing `v6.0.0-rc.4`, the current release packet needed to move from
+the shipped `rc.3` packet to a new packet that describes the exact
+post-`rc.3` release-branch delta. The local `v6.0.0-rc.3` tag was stale during
+the initial check, so the local tag was first refreshed from origin and the
+packet audit was based on the published GitHub prerelease tag target.
+
+## Reviewed Range
+
+- From tag: `v6.0.0-rc.3`
+- From commit: `f1744d36d0bde3c8735ae75a190af45c35087841`
+- To candidate commit: `3f16d7845a92d6bf0c5700728bd70e1f4fe32966`
+- Git range: `v6.0.0-rc.3..3f16d7845a92d6bf0c5700728bd70e1f4fe32966`
+- Commit count: `51`
+- Date span in the range: `2026-05-03` through `2026-05-05`
+- Changed scope: `325` files, `15911` insertions, `11356` deletions
+
+## Review Method
+
+The audit checked the remote `v6.0.0-rc.3` tag target, corrected the stale local
+tag reference, read the full commit subject range in chronological order,
+reviewed the aggregate diff scope, and grouped the commits by changed surface
+and release risk.
+
+Commands used for the coverage pass:
+
+- `git ls-remote origin 'refs/tags/v6.0.0-rc.3*'`
+- `git fetch origin +refs/tags/v6.0.0-rc.3:refs/tags/v6.0.0-rc.3`
+- `git rev-list -n1 v6.0.0-rc.3`
+- `git rev-list --count v6.0.0-rc.3..HEAD`
+- `git log --reverse --format='%h%x09%H%x09%ad%x09%s' --date=short v6.0.0-rc.3..HEAD`
+- `git diff --shortstat v6.0.0-rc.3..HEAD`
+- `git diff --name-only v6.0.0-rc.3..HEAD`
+
+## Commit Coverage Summary
+
+The 51 commits were covered by these release-note buckets:
+
+- hosted tenant identity keys, hosted signup owner IDs, hosted handoff
+  identity, SSO stable principals, checkout magic-link principals, blank
+  magic-link handling, ambiguous email principal handling, contact-email
+  takeover prevention, API token owner metadata, organization runtime access,
+  workspace-owner proof, Stripe webhook principal fixtures, and strict
+  organization identity invariants
+- API-first action planning, action-decision API, CLI action planning, CLI
+  action capability discovery, CLI action audit reads, CLI fleet connection
+  reads, persisted action plans, action execution safety contract, AI action
+  audit lifecycle alignment, and fail-closed dry-run execution
+- self-hosted licensing continuity, removal of monitored-system volume caps,
+  and prevention of raw-cap writes in continuity state
+- root-agent service defaults, API-first Proxmox onboarding, Proxmox setup and
+  runtime token ACLs, Proxmox snapshot polling, Proxmox guest memory fallback,
+  TrueNAS CORE agent supervisor restart, mdadm fallback discovery, Ceph pool
+  threshold identity, storage primary issue impact handling, and metrics
+  rollup write amplification
+- Workloads empty-state source detection, Patrol mobile header controls, public
+  demo admin read hiding, mock-mode legacy sidecar cleanup, mobile Relay docs
+  label cleanup, release key helper module path, and Agent Security docs
+  currentness
+
+## Packet Updates
+
+The current RC packet now points at `v6.0.0-rc.4`:
+
+- `VERSION`
+  - records `6.0.0-rc.4`
+- `docs/RELEASE_NOTES.md`
+  - points current v6 prerelease readers at the RC4 packet
+  - keeps RC3 as historical in-repo packet context
+- `docs/UPGRADE_v6.md`
+  - points upgrade readers at the RC4 release notes, changelog, and operator
+    support pack
+- `docs/releases/RELEASE_NOTES_v6_RC4_DRAFT.md`
+  - records the exact post-`rc.3` commit range and candidate head
+  - summarizes identity, API/CLI, action governance, self-hosted licensing,
+    agent setup, monitoring, storage, Patrol, and mock-mode changes
+- `docs/releases/V6_CHANGELOG_RC4_DRAFT.md`
+  - groups the 51-commit release range into release-risk buckets
+- `docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md`
+  - gives support staff the current rollback, trust-root, identity, action,
+    Proxmox, and escalation language
+- `docs/releases/V6_PRERELEASE_RUNBOOK.md`
+  - updates the active RC example to `6.0.0-rc.4`
+- `docs/release-control/v6/internal/subsystems/deployment-installability.md`
+  - records that RC4 follows the later-corrective-RC packet requirements for
+    rollback, trust-root continuity, and release-control evidence
+
+## Outcome
+
+The audit did not identify a new unhandled code blocker from the commit range.
+It did identify a release-packet currentness gap because the repo still pointed
+operators at `rc.3` while the branch had moved beyond the published `rc.3`
+tag. The gap is addressed by the RC4 packet before release workflow dispatch.
+
+No public issue comment, retitle, closure, or customer-facing message was made
+as part of this packet update.
+
+## Verification
+
+- `git diff --check -- VERSION docs/RELEASE_NOTES.md docs/UPGRADE_v6.md docs/releases/V6_PRERELEASE_RUNBOOK.md docs/releases/RELEASE_NOTES_v6_RC4_DRAFT.md docs/releases/V6_CHANGELOG_RC4_DRAFT.md docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md docs/release-control/v6/internal/records/documentation-currentness-and-legacy-cleanup-v6-rc4-packet-2026-05-05.md docs/release-control/v6/internal/subsystems/deployment-installability.md`
+- `python3 scripts/release_control/documentation_currentness_test.py`
+- `python3 scripts/release_control/render_release_body_test.py`
+- `PYTHONPATH=scripts/release_control python3 -m unittest scripts.release_control.release_promotion_policy_test.ReleasePromotionPolicyTest.test_release_notes_index_points_at_current_rc_packet scripts.release_control.release_promotion_policy_test.ReleasePromotionPolicyTest.test_operator_support_packs_keep_free_first_paid_continuity_wording scripts.release_control.release_promotion_policy_test.ReleasePromotionPolicyTest.test_version_file_matches_current_rc_packet scripts.release_control.release_promotion_policy_test.ReleasePromotionPolicyTest.test_upgrade_guide_points_at_current_rc_support_pack -q`
+- `python3 scripts/release_control/resolve_release_promotion.py --version 6.0.0-rc.4 --rollback-version v5.1.29 --release-notes-file docs/releases/RELEASE_NOTES_v6_RC4_DRAFT.md`
+- `python3 scripts/release_control/status_audit.py --pretty`
diff --git a/docs/release-control/v6/internal/records/rc-to-ga-promotion-readiness-blocked-2026-04-04.md b/docs/release-control/v6/internal/records/rc-to-ga-promotion-readiness-blocked-2026-04-04.md
index 7959f8a27..e6a952747 100644
--- a/docs/release-control/v6/internal/records/rc-to-ga-promotion-readiness-blocked-2026-04-04.md
+++ b/docs/release-control/v6/internal/records/rc-to-ga-promotion-readiness-blocked-2026-04-04.md
@@ -6,8 +6,8 @@
 
 ## Blocking Facts
 
-1. The latest shipped Pulse v6 prerelease tag is `v6.0.0-rc.2`.
-2. That shipped prerelease tag resolves to commit `7b0bdebdff8127228708e84eb836cfd3d7214c08`.
+1. The latest shipped Pulse v6 prerelease tag is `v6.0.0-rc.3`.
+2. That shipped prerelease tag resolves to commit `f1744d36d0bde3c8735ae75a190af45c35087841`.
 3. The selected remote ref `origin/pulse/v6-release` is still behind the current
    local governed branch state, so `Release Dry Run` would exercise stale remote
    control-plane metadata instead of the intended candidate.
@@ -16,7 +16,7 @@
    `pulse/v6-release`.
 5. The active control-plane target is still `v6-product-lane-expansion`, not
    `v6-ga-promotion`.
-6. The active local `pulse/v6-release` branch currently reports `VERSION=6.0.0-rc.3`, so the
+6. The active local `pulse/v6-release` branch currently reports `VERSION=6.0.0-rc.4`, so the
    working line is still prerelease and there is not yet a governed local stable
    `6.0.0` candidate.
 7. There is still no governed `Prerelease-to-GA Rehearsal Record` proving a successful
@@ -29,7 +29,7 @@
 9. There is still no governed `Release Dry Run` artifact or rehearsal record
    exercising stable inputs for:
    - `version=6.0.0`
-   - `promoted_from_tag=v6.0.0-rc.2`
+   - `promoted_from_tag=v6.0.0-rc.3`
    - the artifact-owned candidate stable tag for that rehearsal
    - the artifact-owned promotion channel for that rehearsal
    - the artifact-owned promoted prerelease tag for that rehearsal
@@ -43,7 +43,7 @@
 
 The blocker is no longer missing governance text. The remaining problem is that
 the control plane still holds v6 on the pre-GA prerelease line, the working
-version is still prerelease (`6.0.0-rc.3`), and there is still no exercised
+version is still prerelease (`6.0.0-rc.4`), and there is still no exercised
 `Release Dry Run` record proving the eventual stable `6.0.0`
 candidate is ready for GA-style promotion. Until that rehearsal exists, stable
 users would still be the first real cohort for the final promotion path.
@@ -57,7 +57,7 @@ users would still be the first real cohort for the final promotion path.
    change and release-control records, to `origin/pulse/v6-release`.
 3. Run `Release Dry Run` from `pulse/v6-release` with:
    - `version=6.0.0`
-   - `promoted_from_tag=v6.0.0-rc.2`
+   - `promoted_from_tag=v6.0.0-rc.3`
    - an artifact-owned candidate stable tag matching that rehearsal
    - an artifact-owned promotion channel matching that rehearsal
    - an artifact-owned promoted prerelease tag matching that rehearsal
diff --git a/docs/release-control/v6/internal/status.json b/docs/release-control/v6/internal/status.json
index 27357da5c..55eb3c86f 100644
--- a/docs/release-control/v6/internal/status.json
+++ b/docs/release-control/v6/internal/status.json
@@ -4461,6 +4461,12 @@
           "path": "docs/release-control/v6/internal/records/documentation-currentness-and-legacy-cleanup-v6-rc3-packet-2026-05-01.md",
           "kind": "file",
           "evidence_tier": "local-rehearsal"
+        },
+        {
+          "repo": "pulse",
+          "path": "docs/release-control/v6/internal/records/documentation-currentness-and-legacy-cleanup-v6-rc4-packet-2026-05-05.md",
+          "kind": "file",
+          "evidence_tier": "local-rehearsal"
         }
       ]
     },
diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md
index c0c6daf3a..f1291db3c 100644
--- a/docs/release-control/v6/internal/subsystems/deployment-installability.md
+++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md
@@ -171,7 +171,7 @@ server-side update execution surfaces.
    operator support packet must describe that same candidate instead of leaving
    the branch on a newer version string while the in-repo packet still speaks
    for an older RC.
-   Later corrective RCs such as `rc.3` must also carry the live stable
+   Later corrective RCs such as `rc.3` and `rc.4` must also carry the live stable
    rollback target and any prerelease trust-root continuity caveat in the
    current release notes, changelog, operator support pack, upgrade guide, and
    release-control evidence record before the release workflow is dispatched.
diff --git a/docs/releases/RELEASE_NOTES_v6_RC4_DRAFT.md b/docs/releases/RELEASE_NOTES_v6_RC4_DRAFT.md
new file mode 100644
index 000000000..dab928fb9
--- /dev/null
+++ b/docs/releases/RELEASE_NOTES_v6_RC4_DRAFT.md
@@ -0,0 +1,144 @@
+# Pulse v6.0.0-rc.4 Draft Release Notes
+
+_Draft only. Do not treat this as published until the governed
+`v6.0.0-rc.4` tag and GitHub prerelease exist._
+
+`v6.0.0-rc.4` is a targeted hardening RC after the published `rc.3` prerelease.
+Pulse v5.1.29 remains the current stable line.
+
+The purpose of this RC is to carry the latest post-`rc.3` release-branch
+hardening into a retestable v6 candidate:
+
+- hosted, checkout, magic-link, SSO, Stripe webhook, and organization identity
+  paths now rely on stable principals and fail closed instead of falling back
+  to ambiguous email-shaped identifiers
+- agent-ready operations now have API-first and CLI-first action planning,
+  capability discovery, fleet connection reads, action-decision, execution,
+  and audit surfaces
+- self-hosted v6 licensing continuity keeps monitored-system and child-resource
+  volume unmetered under the current public policy rather than writing raw
+  monitored-system caps back into runtime state
+- Proxmox onboarding, setup-token ACLs, runtime-token ACLs, snapshot polling,
+  guest memory fallback handling, TrueNAS CORE agent restart handling, mdadm
+  fallback discovery, and Ceph pool threshold identity were tightened
+- Workloads empty-state detection, Patrol mobile header controls, mock-mode
+  legacy sidecar cleanup, and agent-security guidance were refreshed
+
+This packet was audited against all `51` commits in the exact `rc.3` to `rc.4`
+candidate range, from the published `v6.0.0-rc.3` tag commit
+`f1744d36d0bde3c8735ae75a190af45c35087841` through candidate commit
+`3f16d7845a92d6bf0c5700728bd70e1f4fe32966`.
+
+## Support Stance
+
+- Pulse v5.1.29 remains the current stable line.
+- Pulse v6 `rc.4` is still an opt-in evaluation build, not the default
+  production recommendation.
+- Existing v5 users should still prefer staging, lab, or otherwise controlled
+  evaluation first.
+- Hosts already pinned to the historical `rc.2` update trust root should not
+  assume unattended auto-update continuity into later prerelease or GA builds.
+  Use a manual reinstall or an explicit trust migration path for `rc.4`.
+- The stable rollback target for this candidate is `v5.1.29`:
+  `./scripts/install.sh --version v5.1.29`
+
+## What Changed Since `rc.3`
+
+### Identity, Auth, And Hosted Trust Boundaries
+
+- Hosted tenant keys, hosted signup owners, hosted handoff identities, and
+  workspace-owner proof now use stable user and organization principals.
+- Blank, ambiguous, or contact-email-derived principals fail closed in
+  magic-link, checkout, and contact-email resolution paths.
+- API token minting records owner metadata and binds owner identity across
+  token creation.
+- Stripe webhook fixtures and organization identity invariants now use stable
+  principals, matching the production identity contract.
+- SSO runtime paths use stable principals, preserving the Community-tier SSO
+  posture from `rc.3`.
+
+### Agent-Ready Operations, CLI, And Auditability
+
+- Pulse now exposes API-first action planning and action-decision paths.
+- The CLI can plan actions, discover action capabilities, read action audits,
+  and read fleet connection state.
+- Action plans persist into the audit trail, AI action audits align with the
+  execution lifecycle, and dry-run action execution fails closed when a request
+  cannot be safely represented.
+- The release-control record now pins the API/CLI-first agent-ready operations
+  direction so MCP remains an adapter over the governed API and CLI contracts.
+
+### Self-Hosted Licensing Continuity
+
+- Current public self-hosted v6 plans keep monitored-system and child-resource volume unmetered.
+- Legacy continuity paths avoid writing raw monitored-system caps back into
+  runtime state.
+- Relay wording remains the `rc.2` model: secure remote access to the Pulse web
+  UI, Pulse Mobile pairing for handoff, push notifications, and 14-day history.
+
+### Agent, Proxmox, TrueNAS, RAID, Ceph, And Monitoring Correctness
+
+- Root agent service defaults were hardened.
+- Proxmox onboarding is API-first, setup-token and runtime-token ACLs are
+  tightened, guest snapshots survive transient polling gaps, and guest memory
+  fallback handling is more reliable.
+- TrueNAS CORE agent supervisor restart handling was corrected.
+- mdadm RAID fallback discovery is more robust.
+- Ceph pool threshold checks now preserve the resource identity needed for
+  correct alert attribution.
+- Metrics rollup writes are less noisy after duplicate or repeated rollup
+  opportunities.
+
+### Product Surface And Operator Guidance
+
+- Workloads empty-state source detection is corrected.
+- Patrol header controls behave better on mobile viewports.
+- Mock mode no longer leaves legacy sidecar drift in the primary runtime path.
+- The Agent Security documentation entry now points operators at the current
+  privilege guidance without leaving a stale support-pack reference.
+- Public demo admin reads stay hidden from the demo surface.
+
+## What Existing v5 Users Should Re-Test In `rc.4`
+
+1. Server upgrade from the current v5 stable line to v6, including the manual
+   or explicit trust-migration path needed for builds after `rc.2`.
+2. Fresh Proxmox LXC install and rollback to v5.1.29.
+3. Proxmox host onboarding, setup-token handling, runtime-token handling,
+   snapshots, and guest memory reporting.
+4. TrueNAS CORE agent restart handling, mdadm RAID fallback discovery, Ceph
+   pool thresholds, and storage issue impact reporting.
+5. Hosted signup, checkout, SSO, magic-link, webhook, and organization-admin
+   flows that depend on stable user and organization principals.
+6. CLI action planning, capability discovery, action audit reads, fleet
+   connection reads, and dry-run action execution.
+7. Workloads empty states, Patrol header controls on mobile, and mock-mode
+   toggling.
+8. Release asset download, checksum/signature, installer, and draft-release
+   validation paths before broader retesting.
+
+## Feedback
+
+Use the `Pulse v6 pre-release feedback` issue template for regressions, upgrade
+failures, licensing continuity problems, platform-specific breakage, or
+actionable UX friction:
+
+- `https://github.com/rcourtman/Pulse/issues/new?template=v6_rc_feedback.yml`
+
+When reporting an `rc.4` problem, include:
+
+- Pulse version
+- upgrade path or fresh-install path
+- installation type
+- whether the host was previously on `rc.1`, `rc.2`, `rc.3`, or v5
+- whether a manual reinstall or trust migration was used after `rc.2`
+- what you expected
+- what happened instead
+- sanitized logs, screenshots, or diagnostics when helpful
+
+## Operator References
+
+- `docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md`
+- `docs/releases/V6_CHANGELOG_RC4_DRAFT.md`
+- `docs/UPGRADE_v6.md`
+- `docs/AGENT_SECURITY.md`
+- `docs/MIGRATION_UNIFIED_NAV.md`
diff --git a/docs/releases/V6_CHANGELOG_RC4_DRAFT.md b/docs/releases/V6_CHANGELOG_RC4_DRAFT.md
new file mode 100644
index 000000000..e3630aa34
--- /dev/null
+++ b/docs/releases/V6_CHANGELOG_RC4_DRAFT.md
@@ -0,0 +1,152 @@
+# Pulse v6.0.0-rc.4 Draft Changelog
+
+_Draft only. This changelog describes the current `pulse/v6-release` delta
+since the published `v6.0.0-rc.3` tag. Do not treat it as published until the
+governed `v6.0.0-rc.4` prerelease exists._
+
+## What `rc.4` changes compared with `rc.3`
+
+`v6.0.0-rc.4` is a targeted release-branch hardening RC. It does not reopen the
+`rc.2` commercial model or replace v5.1.29 as the stable line. It carries the
+post-`rc.3` identity, API/CLI, action governance, self-hosted licensing
+continuity, agent setup, monitoring, storage, and frontend corrections into a
+single retestable candidate.
+
+The main release risk addressed here is identity drift: hosted, checkout,
+magic-link, SSO, webhook, token, and organization paths should not use
+email-shaped fallbacks where stable user and organization principals are
+required. The secondary risk is operational drift: agent-ready operations,
+Proxmox onboarding, storage attribution, and mobile Patrol controls should
+match the current governed v6 architecture before wider RC retesting.
+
+## Commit Coverage Audit
+
+The changelog was audited against every commit in the exact release range for
+the current candidate head:
+
+- `v6.0.0-rc.3`: `f1744d36d0bde3c8735ae75a190af45c35087841`
+- candidate commit: `3f16d7845a92d6bf0c5700728bd70e1f4fe32966`
+- range: `v6.0.0-rc.3..3f16d7845a92d6bf0c5700728bd70e1f4fe32966`
+- commit count: `51`
+- changed scope: `325` files, `15911` insertions, `11356` deletions
+
+Those commits are grouped in this changelog rather than listed one by one. The
+range includes identity hardening, hosted signup and checkout principal
+cleanup, API-first action planning, CLI action and fleet reads, action audit
+execution proof, self-hosted licensing continuity, root-agent and Proxmox
+setup hardening, TrueNAS/RAID/Ceph/storage correctness, Workloads empty-state
+handling, Patrol mobile controls, mock-mode cleanup, and release-control
+evidence.
+
+## Major Changes
+
+### 1. Hosted and organization identity paths use stable principals
+
+The post-`rc.3` range hardens identity ownership across hosted and local
+runtime paths:
+
+- hosted tenant keys and hosted signup owner IDs are canonicalized
+- hosted handoff, checkout magic-link, and blank magic-link principal paths
+  fail closed instead of deriving authority from weak email fallback state
+- contact-email principal takeover and ambiguous email principal resolution
+  are blocked
+- API token minting records owner metadata and binds tokens to stable owner
+  identity
+- organization runtime access and workspace-owner proof use stable user IDs
+- Stripe webhook fixtures and strict organization identity invariants now
+  match the stable-principal model
+- SSO paths use stable principals while keeping SSO as a Community-tier
+  capability
+
+### 2. Agent-ready operations are API-first and CLI-first
+
+The candidate now carries the governed action surface needed for agent-ready
+operations:
+
+- API-first action planning endpoint
+- action-decision API
+- CLI action planning
+- CLI action capability discovery
+- CLI action audit reads
+- CLI fleet connection reads
+- persisted action plans in the audit trail
+- action execution safety contract
+- AI action audits aligned with the execution lifecycle
+- dry-run action execution that fails closed when the requested operation
+  cannot be represented safely
+
+The release-control direction is explicit: MCP may remain as a compatibility
+adapter, but the stable HTTP API and CLI contracts own the product behavior.
+
+### 3. Self-hosted licensing continuity stays free-first
+
+`rc.4` preserves the public self-hosted v6 policy:
+
+- monitored-system and child-resource volume are not metered in the current
+  public self-hosted plans
+- continuity paths do not write raw monitored-system caps back into runtime
+  state
+- Relay remains secure remote access to the Pulse web UI, Pulse Mobile pairing for handoff,
+  push notifications, and 14-day history
+- Pro remains Relay plus AI operations, automation, advanced admin features,
+  and 90-day history
+
+### 4. Agent setup and infrastructure polling are safer
+
+The RC includes additional infrastructure and agent hardening:
+
+- root agent service defaults are stricter
+- Proxmox onboarding follows the API-first path
+- Proxmox setup-token and runtime-token ACLs are tightened
+- Proxmox snapshot polling preserves guest snapshots through transient polling
+  gaps
+- Proxmox guest memory fallback behavior is corrected
+- TrueNAS CORE agent supervisor restart handling is fixed
+- mdadm RAID fallback discovery is more robust
+
+### 5. Monitoring, storage, and alert attribution are corrected
+
+The range also includes:
+
+- reduced metrics rollup write amplification
+- storage primary issue impact handling
+- Ceph pool threshold resource identity preservation
+- Workloads empty-state source detection
+- mock-mode legacy sidecar cleanup
+
+### 6. Patrol and docs are aligned with the current RC
+
+Patrol header controls now fit mobile viewports more reliably. The Agent
+Security documentation entry points to the current guidance instead of leaving
+operators with a stale RC support-pack reference. Public demo admin reads stay
+hidden.
+
+## What existing v5 users should re-test in `rc.4`
+
+1. v5.1.29 to v6 server upgrade and rollback to v5.1.29.
+2. The explicit post-`rc.2` trust migration or manual reinstall path.
+3. Hosted signup, checkout, SSO, magic-link, token, webhook, and organization
+   ownership flows.
+4. CLI action planning, capability discovery, action audit reads, fleet
+   connection reads, and dry-run action execution.
+5. Proxmox onboarding, setup-token ACLs, runtime-token ACLs, snapshots, and
+   guest memory reporting.
+6. TrueNAS CORE, mdadm RAID fallback, Ceph pool thresholds, and storage issue
+   impact presentation.
+7. Workloads empty states, Patrol header controls on mobile, and mock-mode
+   toggling.
+8. Release artifact download, checksum/signature, and installer validation
+   paths before broad retesting.
+
+## Evidence Appendix
+
+For the code-backed evidence packet that maps these claims to the current
+release line, see:
+
+- `docs/release-control/v6/internal/records/documentation-currentness-and-legacy-cleanup-v6-rc4-packet-2026-05-05.md`
+- `docs/release-control/v6/internal/IDENTITY_INVARIANTS.md`
+- `docs/release-control/v6/internal/records/agent-lifecycle-root-agent-hardening-2026-05-05.md`
+- `docs/release-control/v6/internal/records/agent-lifecycle-proxmox-api-first-onboarding-2026-05-05.md`
+- `docs/release-control/v6/internal/records/agent-lifecycle-proxmox-setup-permission-proof-2026-05-05.md`
+- `docs/release-control/v6/internal/records/agent-lifecycle-proxmox-runtime-token-permission-proof-2026-05-05.md`
+- `docs/release-control/v6/internal/records/known-rc-issue-closure-for-ga-metrics-write-amplification-2026-05-03.md`
diff --git a/docs/releases/V6_PRERELEASE_RUNBOOK.md b/docs/releases/V6_PRERELEASE_RUNBOOK.md
index 6e0eadbc7..d7bd80dac 100644
--- a/docs/releases/V6_PRERELEASE_RUNBOOK.md
+++ b/docs/releases/V6_PRERELEASE_RUNBOOK.md
@@ -63,7 +63,7 @@ artifacts, or to an explicitly verified paid container image, rather than the pu
 ## Versioning Rules
 
 - v5 stable examples: `5.1.14`
-- v6 prerelease examples: `6.0.0-rc.1`, `6.0.0-rc.2`, `6.0.0-rc.3`
+- v6 prerelease examples: `6.0.0-rc.1`, `6.0.0-rc.2`, `6.0.0-rc.3`, `6.0.0-rc.4`
 - v6 GA example: `6.0.0`
 
 The workflow auto-marks `-rc.N`/`-alpha.N`/`-beta.N` as prerelease.
@@ -93,7 +93,7 @@ The workflow auto-marks `-rc.N`/`-alpha.N`/`-beta.N` as prerelease.
 1. Update version on `pulse/v6-release`:
 
 ```bash
-export RC_VERSION="6.0.0-rc.3"
+export RC_VERSION="6.0.0-rc.4"
 
 git checkout pulse/v6-release
 git pull --ff-only
@@ -139,7 +139,7 @@ git push origin pulse/v6-release
 
 6. Canary rollout:
    - Upgrade a small user subset first.
-   - Collect regressions, fix on `pulse/v6-release`, then cut `rc.2`/`rc.3` as needed.
+   - Collect regressions, fix on `pulse/v6-release`, then cut later RCs as needed.
 
 ## Keep v5 Stable During v6 RC
 
diff --git a/docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md b/docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md
new file mode 100644
index 000000000..d0a6cd088
--- /dev/null
+++ b/docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md
@@ -0,0 +1,192 @@
+# Pulse v6 RC4 Draft Operator Support Pack
+
+_Draft only. Use this as the working support brief for the planned
+`v6.0.0-rc.4` candidate until the final prerelease notes are published._
+
+## Support Stance
+
+- Pulse v5.1.29 remains the current stable line.
+- Pulse v6 `rc.4` is an opt-in evaluation build, not the default production
+  recommendation.
+- `rc.4` should be described as a targeted post-`rc.3` hardening RC covering
+  stable identity principals, agent-ready API/CLI operations, action audit
+  execution, self-hosted licensing continuity, Proxmox and root-agent
+  hardening, storage/monitoring corrections, Workloads empty states, and
+  Patrol mobile controls.
+- Self-hosted SSO is included with Community and higher tiers. Do not describe
+  SAML or multi-provider SSO as a Pro-only upgrade path for this RC.
+- Stable-channel installer resolution must stay on the latest stable semver
+  tag even if GitHub's floating latest-release redirect currently points at an
+  RC.
+- Systems pinned to the historical `rc.2` update trust root should use a manual
+  reinstall or explicit trust migration for later prerelease or GA builds.
+
+## Short Answers
+
+### Is `rc.4` the stable release?
+
+No. The current stable release is v5.1.29. `rc.4` is still a v6 prerelease for
+controlled evaluation.
+
+### Should production v5 users upgrade immediately?
+
+No. The recommended RC posture is still staging, lab, or controlled evaluation
+first.
+
+### What is the rollback target?
+
+Use v5.1.29:
+
+`./scripts/install.sh --version v5.1.29`
+
+### Can `rc.2` systems auto-update directly to `rc.4`?
+
+Do not promise unattended continuity from `rc.2` to `rc.4`. Hosts pinned to the
+historical `rc.2` update trust root need a manual reinstall or explicit trust
+migration path for later prerelease or GA builds.
+
+### Does self-hosted v6 still cap monitored systems?
+
+No for the current public self-hosted plans. Community, Relay, and Pro include
+core self-hosted monitoring by default.
+
+Current plan shorthand:
+
+- Community:
+  core monitoring included, OIDC/SAML SSO with multi-provider support, 7-day
+  history
+- Relay:
+  core monitoring included, secure remote access to the Pulse web UI,
+  Pulse Mobile pairing for handoff, push notifications, and 14-day history
+- Pro:
+  Relay plus AI operations, automation, advanced admin features, and 90-day
+  history
+
+### What happens to existing paid Pulse Pro customers in v6?
+
+Use this cohort breakdown:
+
+- Legacy recurring monthly or annual subscribers from v5 or earlier who were
+  already active before the public v6 pricing cutover:
+  keep the current recurring price, with self-hosted monitoring and
+  child-resource volume not metered while the subscription remains continuously
+  active under the current v6 policy.
+- Existing lifetime customers:
+  remain permanently valid, with self-hosted monitoring and child-resource
+  volume not metered under the current v6 policy.
+- Legacy paid v5 licenses migrated into v6 outside the recurring grandfathered
+  path:
+  can still exchange into the v6 activation model without repurchasing.
+- Former recurring subscribers who already canceled or later lapse:
+  any later return uses current public v6 pricing rather than resuming the old
+  grandfathered terms.
+
+### What changed from `rc.3` that users should notice immediately?
+
+- hosted signup, checkout, magic-link, SSO, webhook, API token, and
+  organization ownership paths now depend on stable principals
+- ambiguous email fallback, contact-email takeover, and blank principal paths
+  fail closed
+- action planning, capability discovery, action audit reads, fleet connection
+  reads, and action decisions are available through governed API/CLI surfaces
+- action plans persist into the audit trail and dry-run action execution fails
+  closed when unsafe
+- monitored-system volume caps are removed from the current self-hosted v6
+  runtime model
+- Proxmox onboarding is API-first, token ACLs are tightened, snapshots are more
+  stable through polling gaps, and guest memory fallbacks are corrected
+- TrueNAS CORE agent restart handling, mdadm fallback discovery, Ceph pool
+  threshold identity, and storage issue impact handling are corrected
+- Workloads empty states and Patrol header controls behave better
+- mock mode no longer leaves legacy sidecar drift in the primary runtime path
+
+### What if a hosted, checkout, magic-link, or SSO flow still keys access by email?
+
+Escalate it as an identity regression. `rc.4` expects stable user and
+organization principals at those trust boundaries.
+
+### What if CLI action planning or dry-run execution fails?
+
+Collect the CLI command, API response, action plan ID if present, audit entry
+if present, current Pulse version, and sanitized server logs. Dry-run execution
+should fail closed when the request cannot be represented safely, but the
+failure should still be inspectable.
+
+### What if a fresh Proxmox LXC stable install lands on a v6 RC?
+
+Treat that as a release-blocking install regression. The stable path should
+resolve to v5.1.29 unless the user intentionally chose a v6 prerelease.
+
+### What if a Docker agent duplicates or loses identity after recreation?
+
+Collect logs and escalate. `rc.4` keeps the prior reconnect-token and
+host-identity binding work and adds stricter root-agent and Proxmox token ACL
+hardening.
+
+### Are public issue comments or closures required for the RC?
+
+No public GitHub state changes are required just to prepare this packet. Draft
+comments, closures, or retitles still need explicit maintainer approval before
+posting.
+
+## Recommended Evaluation Path
+
+1. Back up the current system and keep direct console access available.
+2. Confirm the current stable rollback command:
+   `./scripts/install.sh --version v5.1.29`
+3. If the host was on `rc.2`, use a manual reinstall or explicit trust
+   migration path rather than assuming unattended auto-update continuity.
+4. Upgrade the Pulse server in a staging or otherwise controlled environment.
+5. Verify server health, version, logs, and update UI before upgrading agents.
+6. Re-test hosted signup, checkout, SSO, magic-link, token, webhook, and
+   organization ownership flows.
+7. Re-test CLI action planning, capability discovery, action audit reads, fleet
+   connection reads, and dry-run execution.
+8. Re-test Proxmox onboarding, setup-token ACLs, runtime-token ACLs, snapshots,
+   guest memory, TrueNAS CORE agent restart, mdadm fallback discovery, Ceph
+   thresholds, and storage issue impact presentation.
+9. Re-test Workloads empty states, Patrol header controls on mobile, and mock
+   mode toggling.
+10. Re-test release artifact download, checksum/signature, installer, and
+   draft validation paths before broader retesting.
+11. Upgrade agents separately only when the user is explicitly testing the
+   v5-to-v6 agent path.
+
+## Ask For These Details
+
+When a user reports an `rc.4` problem, ask for:
+
+- current version and prior version
+- install type
+- whether the host was previously on v5, `rc.1`, `rc.2`, or `rc.3`
+- whether a manual reinstall or trust migration was used after `rc.2`
+- whether the issue happened during server upgrade, agent upgrade, identity
+  handoff, checkout, SSO, action planning, alerting, backup/recovery, platform
+  inventory, or first use
+- whether Unified Agents were upgraded yet
+- expected result
+- actual result
+- sanitized logs, screenshots, and diagnostics
+
+## Escalate Immediately
+
+Escalate without asking the user to keep experimenting when the report involves:
+
+- failed install or failed upgrade with no recovery path
+- stable install path unexpectedly landing on a v6 prerelease
+- duplicate or missing agent identity after a v5-to-v6 upgrade
+- hosted, checkout, magic-link, SSO, webhook, or token access granted to the
+  wrong principal
+- action execution that proceeds when dry-run or plan validation failed
+- monitoring or reporting that stops entirely after upgrade
+- rollback failure or inability to return to v5.1.29
+- SSO setup or login blocked by an unexpected paid-license requirement
+- data-loss, destructive behavior, or security-sensitive regressions
+
+## Canonical References
+
+- `docs/releases/RELEASE_NOTES_v6_RC4_DRAFT.md`
+- `docs/releases/V6_CHANGELOG_RC4_DRAFT.md`
+- `docs/UPGRADE_v6.md`
+- `docs/AGENT_SECURITY.md`
+- `docs/MIGRATION_UNIFIED_NAV.md`
diff --git a/scripts/release_control/record_rc_to_ga_blocked.py b/scripts/release_control/record_rc_to_ga_blocked.py
index edf28125b..28d4f17a9 100644
--- a/scripts/release_control/record_rc_to_ga_blocked.py
+++ b/scripts/release_control/record_rc_to_ga_blocked.py
@@ -173,7 +173,7 @@ def build_blocked_record(*, record_date: str) -> str:
     active_target_id = str(control_plane["active_target_id"])
     accidental_tags = excluded_accidental_rc_tags(status, stable_version)
     rc_tag = latest_matching_rc_tag(stable_version, excluded_tags=accidental_tags)
-    rc_commit = _run_git("rev-parse", rc_tag) if rc_tag else ""
+    rc_commit = _run_git("rev-list", "-n1", rc_tag) if rc_tag else ""
     ga_date, v5_eos_date = parse_release_dates()
     target_is_ga_promotion = active_target_id == "v6-ga-promotion"
     remote_stable_branch_release_dry_run = branch_release_dry_run_workflow(stable_branch)
diff --git a/scripts/release_control/release_promotion_policy_test.py b/scripts/release_control/release_promotion_policy_test.py
index 0101c7596..f730fd40c 100644
--- a/scripts/release_control/release_promotion_policy_test.py
+++ b/scripts/release_control/release_promotion_policy_test.py
@@ -136,12 +136,16 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
         self.assertIn("docs/releases/RELEASE_NOTES_v6_RC3_DRAFT.md", release_index)
         self.assertIn("docs/releases/V6_CHANGELOG_RC3_DRAFT.md", release_index)
         self.assertIn("docs/releases/V6_RC3_OPERATOR_SUPPORT_PACK_DRAFT.md", release_index)
+        self.assertIn("docs/releases/RELEASE_NOTES_v6_RC4_DRAFT.md", release_index)
+        self.assertIn("docs/releases/V6_CHANGELOG_RC4_DRAFT.md", release_index)
+        self.assertIn("docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md", release_index)
 
     def test_operator_support_packs_keep_free_first_paid_continuity_wording(self) -> None:
         for rel in (
             "docs/releases/V6_RC_OPERATOR_SUPPORT_PACK.md",
             "docs/releases/V6_RC2_OPERATOR_SUPPORT_PACK_DRAFT.md",
             "docs/releases/V6_RC3_OPERATOR_SUPPORT_PACK_DRAFT.md",
+            "docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md",
         ):
             with self.subTest(rel=rel):
                 support_pack = read(rel)
@@ -217,6 +221,11 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
                     "docs/releases/V6_CHANGELOG_RC3_DRAFT.md",
                     "docs/releases/V6_RC3_OPERATOR_SUPPORT_PACK_DRAFT.md",
                 ),
+                "6.0.0-rc.4": (
+                    "docs/releases/RELEASE_NOTES_v6_RC4_DRAFT.md",
+                    "docs/releases/V6_CHANGELOG_RC4_DRAFT.md",
+                    "docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md",
+                ),
             }
             self.assertIn(current_version, packets)
 
@@ -254,8 +263,9 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
             self.assertIn("docs/releases/V6_CHANGELOG.md", upgrade_guide)
             self.assertNotIn("docs/releases/V6_RC2_OPERATOR_SUPPORT_PACK_DRAFT.md", upgrade_guide)
         else:
-            self.assertEqual(current_version, "6.0.0-rc.3")
-            self.assertIn("docs/releases/V6_RC3_OPERATOR_SUPPORT_PACK_DRAFT.md", upgrade_guide)
+            self.assertEqual(current_version, "6.0.0-rc.4")
+            self.assertIn("docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md", upgrade_guide)
+            self.assertNotIn("docs/releases/V6_RC3_OPERATOR_SUPPORT_PACK_DRAFT.md", upgrade_guide)
             self.assertNotIn("docs/releases/V6_RC2_OPERATOR_SUPPORT_PACK_DRAFT.md", upgrade_guide)
             self.assertNotIn("docs/releases/V6_RC_OPERATOR_SUPPORT_PACK.md", upgrade_guide)
 
@@ -507,7 +517,7 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
         self.assertIn("operators know the update signer changed", normalize_ws(runbook))
         self.assertIn("manual reinstall or other explicit trust-migration path", normalize_ws(runbook))
         self.assertIn("points at the current in-repo draft packet", runbook)
-        self.assertIn('export RC_VERSION="6.0.0-rc.3"', runbook)
+        self.assertIn('export RC_VERSION="6.0.0-rc.4"', runbook)
         self.assertIn("printf '%s\\n' \"$RC_VERSION\" > VERSION", runbook)
         self.assertIn("markdown text from the current release-notes packet", runbook)
         self.assertIn("Keep the current release-notes, changelog, and operator-support packet in", runbook)
diff --git a/scripts/release_control/render_release_body_test.py b/scripts/release_control/render_release_body_test.py
index b1c58c11e..d5f85be11 100644
--- a/scripts/release_control/render_release_body_test.py
+++ b/scripts/release_control/render_release_body_test.py
@@ -99,6 +99,9 @@ Old metadata section.
             "docs/releases/RELEASE_NOTES_v6_RC3_DRAFT.md",
             "docs/releases/V6_CHANGELOG_RC3_DRAFT.md",
             "docs/releases/V6_RC3_OPERATOR_SUPPORT_PACK_DRAFT.md",
+            "docs/releases/RELEASE_NOTES_v6_RC4_DRAFT.md",
+            "docs/releases/V6_CHANGELOG_RC4_DRAFT.md",
+            "docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md",
         )
 
         for relative_path in packet_paths:
@@ -131,6 +134,25 @@ Old metadata section.
             support_pack,
         )
 
+    def test_rc4_packet_records_commit_coverage_and_identity_hardening(self) -> None:
+        repo_root = Path(__file__).resolve().parents[2]
+        release_notes = (repo_root / "docs/releases/RELEASE_NOTES_v6_RC4_DRAFT.md").read_text(
+            encoding="utf-8"
+        )
+        changelog = (repo_root / "docs/releases/V6_CHANGELOG_RC4_DRAFT.md").read_text(
+            encoding="utf-8"
+        )
+        support_pack = (
+            repo_root / "docs/releases/V6_RC4_OPERATOR_SUPPORT_PACK_DRAFT.md"
+        ).read_text(encoding="utf-8")
+
+        self.assertIn("3f16d7845a92d6bf0c5700728bd70e1f4fe32966", release_notes)
+        self.assertIn("commit count: `51`", changelog)
+        self.assertIn("stable identity principals", support_pack)
+        self.assertIn("API-first action planning", changelog)
+        self.assertIn("monitored-system and child-resource volume unmetered", release_notes)
+        self.assertIn("Pulse Mobile pairing for handoff", support_pack)
+
 
 if __name__ == "__main__":
     unittest.main()