Complete RC6 supply chain gates

docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md

@@ -147,9 +147,9 @@ editions and licences must still pass source-specific probes before activation.
 | RC-1 | complete | backup, restore and data safety |
 | RC-2 | complete | health, capabilities and stale-runtime correctness |
 | RC-3 | complete | temporal detection/QA correctness and observability |
-| RC-4 | in progress | national/maritime scope and provider coverage contracts |
-| RC-5 | pending | deployment, secrets, configuration, fresh install and rollback |
-| RC-6 | pending | complete CI, dependency and supply-chain gates |
+| RC-4 | complete | national/maritime scope and provider coverage contracts |
+| RC-5 | complete | deployment, secrets, configuration, fresh install and rollback |
+| RC-6 | in progress | complete CI, dependency and supply-chain gates |
 | RC-7 | pending | critical API envelope typing and contract validation |
 | RC-8 | pending | frontend and browser E2E release journeys |
 | RC-9 | pending | loading, accessibility and performance hardening |
@@ -291,10 +291,13 @@ errors.
 
 ## RC-4 - Belgium and North Sea coverage foundation
 
-**State: in progress.** The national coverage registry, canonical
-catalog/resolve API, explicit NGI/RBINS operator, frontend selection matrix and
-focused safety tests are implemented. Local readiness is green. Tower
-fetch-only, persistence, live API and browser acceptance remain the phase exit.
+**State: complete.** Tower persists one idempotent national workspace with
+eight distinct land/maritime areas and six ready authoritative datasets
+containing 685 features. The coverage catalog and resolver report operational,
+partial, not-configured and unsupported states honestly for Belgium, all three
+regions and the Belgian maritime zones. Live browser acceptance proved the
+national default context, coverage-only selection and responsive 390/1920 px
+layouts while unavailable detailed regional themes remain explicit.
 
 ### Work
 
@@ -342,6 +345,15 @@ fetch-only, persistence, live API and browser acceptance remain the phase exit.
 
 ## RC-5 - Production deployment and rollback
 
+**State: complete.** Tower runs a commit-plus-AI-profile immutable image with
+OCI revision/build labels. Repeated deploys reuse the exact image and preserve
+the actual prior release. A fresh install passed on isolated volumes, manual
+rollback passed against retained production mounts, and the release image
+upgraded a checksum-verified 1.4 GiB backup in a generated temporary database
+at PostGIS 3.6/Alembic `202607160001` before removing it. Production startup is
+fail-closed for default secrets and invalid upload limits, nginx/backend limits
+are aligned, and all operator-owned settings are editable in Unraid.
+
 ### Work
 
 - align backend, nginx and proxy upload/time limits;