Add Flemish bathymetry partition workflow

docs/API_CONTRACTS.md

@@ -2061,10 +2061,20 @@ sets an explicit Ollama context window and returns
 ### GET `/api/v1/projects/{project_id}/datasets/bathymetry/sources`
 
 Returns the governed bathymetry source registry in the canonical envelope.
-VHA inland profiles are `operational`. MDK Belgian Continental Shelf and SPW
-Walloon bathymetry remain `available_not_integrated`; they cannot be acquired
-through this contract until their raster/download and vertical-datum flows
-pass live validation.
+VHA inland profiles are `operational`. MDK Belgian Continental Shelf is
+`probe_only`; SPW Walloon bathymetry remains `available_not_integrated`.
+Neither source can be acquired until its raster/download and vertical-datum
+flow passes live validation.
+
+### GET `/api/v1/projects/{project_id}/datasets/bathymetry/sources/mdk_bcp_bathymetry/readiness`
+
+Runs one bounded, read-only WCS 1.0.0 `GetCapabilities` request with mandatory
+system TLS verification and a configured response-size limit. Status is one
+of `disabled`, `invalid_configuration`, `tls_error`,
+`endpoint_unavailable`, `invalid_capabilities` or `reachable`. A reachable
+response lists coverage identifiers, advertised formats and CRS values, but
+always returns `acquisition_supported=false`. There is no insecure TLS
+fallback and no `GetCoverage` request.
 
 ### POST `/api/v1/projects/{project_id}/datasets/bathymetry/profiles/acquire`
 
@@ -2089,3 +2099,18 @@ The acquired Dataset uses
 `reference_layer_name=bathymetry_profiles`. Existing vector content and
 selection endpoints provide GeoJSON and metrics. The contract does not expose
 a continuous bathymetric surface, current water depth or water volume.
+
+### POST `/api/v1/projects/{project_id}/datasets/bathymetry/profiles/partitions/finalize`
+
+Finalizes a complete municipality-partition manifest. The request supplies a
+scope key, every expected municipality Area id, one ready VHA Dataset id for
+each non-empty partition, explicit Area ids with zero source profiles, a
+SHA-256 manifest identity and observation time. The backend verifies project,
+Area, provider, Dataset and one-Dataset-per-Area consistency. Only a complete
+accounting sets `partitioned_source_audit=true` and
+`regional_partitions_complete=true`; partial operator runs remain hidden at
+regional scope.
+
+Future provider output continues to use DatasetService and, for vectors,
+VectorFeatureService. Arbitrary service URLs, browser-side fetches, insecure
+TLS bypasses and startup downloads remain forbidden.

docs/BATHYMETRY_EXPANSION_ROADMAP.md

@@ -120,12 +120,21 @@ bed evolution.
 
 ## Implementation order
 
-1. Operate and validate the Mol VHA profile Dataset and map flow.
-2. Add VHA municipal partition orchestration for Flanders.
+1. Operate and validate the Mol VHA profile Dataset and map flow. **Done.**
+2. Add VHA municipal partition orchestration for Flanders. **Implemented;
+   complete live provisioning remains an explicit operator run.**
 3. Implement a bounded MDK WCS probe, then acquisition behind live evidence.
+   **Probe implemented. Acquisition blocked because the live endpoint fails
+   strict hostname validation and does not expose usable capabilities.**
 4. Implement SPW download staging and vertical-datum metadata validation.
 5. Add maritime boundaries as separate authoritative scope layers.
 6. Add cross-source vertical-datum transformation only with authoritative
    grids/parameters and uncertainty tests.
 7. Add volume only after a compatible measured or modeled water-surface source
    is part of the same analysis contract.
+
+The Flanders scope is land-only and is dynamically derived from the complete
+current VRBG municipality collection (285 members at the 2026-07-17
+validation). Belgium is not represented by expanding that polygon. Wallonia,
+Brussels, the territorial sea and the Belgian EEZ/continental shelf require
+their own authoritative adapters and legal scope labels.

docs/CODEX_EXECUTION_LOG.md

@@ -10054,3 +10054,41 @@ Validation:
   historical survey range `1877-2020` and loaded all 828 persisted objects.
   The browser console contained no warnings or errors and the 1265x720
   viewport had no horizontal document overflow.
+
+## Sprint 236 - Flemish bathymetry partitions and safe North Sea probe (2026-07-17)
+
+Implemented:
+- Added a dynamic Flanders scope operator that discovers the complete current
+  official VRBG RefGem municipality inventory instead of freezing a fragile
+  hand-maintained list. It validates unique NIS codes/names, polygonal source
+  features and a 270..300 safety range before creating artifacts or API state.
+- Added an atomic, resumable VHA municipality coordinator. Every partition is
+  exact-Area clipped and persisted through the existing acquisition endpoint;
+  failures, explicit zero-profile results and ready Dataset ids remain in the
+  checksum-bound coverage manifest.
+- Added server-side partition finalization. Regional activation requires exact
+  accounting for every expected municipality, one ready VHA Dataset per
+  non-empty Area and explicit no-profile Area ids. Dataset and DatasetVersion
+  metadata retain the manifest identity and completeness flags.
+- Added a strict-TLS, response-bounded MDK WCS GetCapabilities probe and a
+  concise Sources-workspace control. It never performs GetCoverage, never
+  disables certificate verification and always leaves acquisition disabled.
+- Packaged the Flanders scope, VHA coordinator and MDK probe operators in the
+  all-in-one image and exposed their bounded runtime settings in Compose and
+  the Unraid deployment configuration.
+
+Validation:
+- Official VRBG fetch-only validation returned 285 unique municipalities, an
+  exact union of 13,625.73 km2 and WGS84 bounds
+  `[2.54132923, 50.68749237, 5.9111094, 51.50511313]`.
+- The live MDK metadata endpoint currently fails strict hostname validation:
+  `bathy.agentschapmdk.be` presents a certificate for `*.l27powered.eu`.
+  Diagnostic requests to both the previously configured and current metadata
+  paths returned HTTP 404 after an explicitly external, non-application
+  insecure inspection. GeoIntel itself reports `tls_error` and provides no
+  bypass.
+- The complete readiness gate passed 920 backend tests, backend compilation,
+  documentation/contract audits, 115 documented API routes, Alembic head
+  `202607160001`, frontend TypeScript typecheck and the production Vite build.
+- Live Docker deployment and controlled Flanders provisioning are recorded
+  after the repository commit below.

docs/DATABASE_IMPLEMENTATION_PLAN.md

@@ -2,6 +2,14 @@
 
 Database: PostgreSQL + PostGIS.
 
+Bathymetry regional completeness requires no new table. Every VHA municipality
+partition remains an ordinary `datasets` row plus `vector_features`. After a
+complete server-validated manifest, Dataset and DatasetVersion metadata retain
+`partition_scope_key`, partition counts, the manifest SHA-256,
+`partitioned_source_audit=true` and
+`regional_partitions_complete=true`. Empty source partitions are recorded in
+the manifest provenance and never represented by fabricated features.
+
 ## Rules
 
 - Store geometries in PostGIS with explicit SRID.

docs/DATA_SOURCES.md

@@ -722,7 +722,11 @@ are not filled by fabricated OCR output.
 The following sources are audited but not yet operational:
 
 - MDK Dieptemodel Belgisch Continentaal Plat/Noordzee: 20 x 20 m continuous
-  raster in LAT, exposed through WCS/WMTS.
+  raster in LAT, exposed through WCS/WMTS. GeoIntel now has a strict-TLS,
+  read-only GetCapabilities probe. On 2026-07-17 the official metadata
+  endpoint presented a certificate for another hostname and returned no
+  usable capabilities path; status therefore remains `tls_error` and raster
+  acquisition is disabled.
 - SPW bathymetry of navigable waterways and reservoir lakes: 0.5 m bed
   elevation and XYZ data in mDNG.
 - Port of Antwerp-Bruges periodic soundings: catalog candidate pending a
@@ -732,3 +736,13 @@ See `docs/BATHYMETRY_EXPANSION_ROADMAP.md`. TAW, LAT and mDNG remain separate
 until an authoritative vertical transformation is implemented and tested.
 The territorial sea, EEZ and continental shelf are separate scope layers and
 must be labelled according to their legal meaning.
+
+The official VRBG RefGem collection currently exposes 285 Flemish
+municipalities. `scripts/provision_flanders_geographic_scope.py` validates the
+complete inventory, produces checksum-bound land-boundary artifacts and
+creates one persisted municipality Area per source feature. The separate
+`scripts/provision_flanders_bathymetry_profiles.py` coordinator acquires VHA
+profiles per Area, writes an atomic resumable manifest and requests regional
+activation only after all 285 partitions are accounted for. A municipality
+with zero source points is retained as an explicit no-profile partition, not
+silently omitted.

docs/DATA_SPECIFICATION.md

@@ -222,7 +222,30 @@ Raster / gemodelleerd overstromingsgevaar.
 
 ### Prioriteit
 
-P5 overstromingsscenario's operationeel voor Mol; bathymetrie blijft open.
+P5 overstromingsscenario's operationeel. VHA-dwarsprofielen zijn als
+historische puntmetingen operationeel voor Mol en partitioneerbaar voor alle
+officiële Vlaamse gemeente-Areas. Ze blijven strikt gescheiden van dit
+scenario-raster en leveren geen gebiedsdekkende bathymetrie of volume.
+
+## Bathymetry partition metadata
+
+Een VHA-profiel-Dataset behoudt `partition_area_id`,
+`partition_area_name`, `municipality`, meetdatumbereik en exacte aantallen.
+Regionale Vlaamse dekking is alleen geldig wanneer de server een volledig
+manifest voor de actuele officiële gemeente-inventaris heeft gevalideerd.
+Daarna bevatten Dataset en DatasetVersion:
+
+- `partition_scope_key`
+- `partition_count`, `data_partition_count` en `no_profile_partition_count`
+- `partition_manifest_sha256`
+- `partitioned_source_audit=true`
+- `regional_partitions_complete=true`
+
+Een no-profile partition is bronbewijs dat de begrensde VHA-query nul punten
+opleverde. Er worden nooit lege of kunstmatige profielobjecten aangemaakt.
+
+MDK Noordzee blijft `probe_only`: WCS-capabilities kunnen veilig worden
+gecontroleerd, maar er bestaat nog geen toegestane rasteracquisitie.
 
 ## LAS/LAZ LiDAR
 

docs/TODO.md

@@ -751,11 +751,12 @@ This file now starts with the current implementation status. Older preparation/b
   creates a new immutable Dataset with official `YYYY.NN` source version.
 # Bathymetry follow-up
 
-- [ ] Add governed municipality partition orchestration for all of Flanders
+- [x] Add governed municipality partition orchestration for all of Flanders
   after the Mol VHA operator passes live acceptance.
-- [ ] Add read-only MDK WCS capability/TLS probe and maritime scope metadata.
+- [x] Add read-only MDK WCS capability/TLS probe and maritime scope metadata.
 - [ ] Add bounded MDK GeoTIFF acquisition only after live CRS, LAT, nodata and
-  response-limit validation.
+  response-limit validation. Current official endpoint is blocked by TLS
+  hostname mismatch and unavailable capabilities; never bypass verification.
 - [ ] Add SPW staged-download adapter with mDNG metadata and survey-epoch
   coverage validation.
 - [ ] Add authoritative territorial-sea, EEZ and continental-shelf boundary