Record healthy GitOps digest release and remaining automation gates

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e241-8285-7a63-8c0c-51c9cb824dc3

docs/gitops-release.md

@@ -64,3 +64,20 @@ and revert its source revision through ArgoCD on failure. Prove both successful
 promotion and failed-health rollback before claiming unattended operation.
 The 24-hour observation begins with the recorded successful adoption; a stateful
 failure or unintended spec change invalidates that observation.
+
+## Live proof and current gates
+
+The 2026-09-27 adoption and subsequent digest release are complete and healthy.
+See [evidence](evidence/2026-09-27-gitops-adoption.json) for exact revisions,
+images, CI runs, nine-resource inventory, scheduled smoke and retention coverage.
+All three components now use registry digests of their previous binaries.
+Conservative healthy observation starts at 13:38:21Z after the digest rollout;
+earliest eligibility is September 28 at 15:38:21 Berlin, conditional on health.
+
+The registry retention implementation currently protects tags, not digest-to-version
+mappings. Three baseline tag aliases have been added to the persistent protection
+union and checked with the owner parser. Every release must protect aliases for
+live and rollback digests until RPF-WP-0048-T03 supplies general digest protection.
+Unattended promotion is not ready merely because the admission fixtures pass:
+authenticated receipts, identity binding, retention coverage and failed-health
+rollback proof remain required in ACTIVITY-WP-0041-T03.