Add Flemish bathymetry partition workflow

docs/CODEX_EXECUTION_LOG.md

@@ -10054,3 +10054,41 @@ Validation:
   historical survey range `1877-2020` and loaded all 828 persisted objects.
   The browser console contained no warnings or errors and the 1265x720
   viewport had no horizontal document overflow.
+
+## Sprint 236 - Flemish bathymetry partitions and safe North Sea probe (2026-07-17)
+
+Implemented:
+- Added a dynamic Flanders scope operator that discovers the complete current
+  official VRBG RefGem municipality inventory instead of freezing a fragile
+  hand-maintained list. It validates unique NIS codes/names, polygonal source
+  features and a 270..300 safety range before creating artifacts or API state.
+- Added an atomic, resumable VHA municipality coordinator. Every partition is
+  exact-Area clipped and persisted through the existing acquisition endpoint;
+  failures, explicit zero-profile results and ready Dataset ids remain in the
+  checksum-bound coverage manifest.
+- Added server-side partition finalization. Regional activation requires exact
+  accounting for every expected municipality, one ready VHA Dataset per
+  non-empty Area and explicit no-profile Area ids. Dataset and DatasetVersion
+  metadata retain the manifest identity and completeness flags.
+- Added a strict-TLS, response-bounded MDK WCS GetCapabilities probe and a
+  concise Sources-workspace control. It never performs GetCoverage, never
+  disables certificate verification and always leaves acquisition disabled.
+- Packaged the Flanders scope, VHA coordinator and MDK probe operators in the
+  all-in-one image and exposed their bounded runtime settings in Compose and
+  the Unraid deployment configuration.
+
+Validation:
+- Official VRBG fetch-only validation returned 285 unique municipalities, an
+  exact union of 13,625.73 km2 and WGS84 bounds
+  `[2.54132923, 50.68749237, 5.9111094, 51.50511313]`.
+- The live MDK metadata endpoint currently fails strict hostname validation:
+  `bathy.agentschapmdk.be` presents a certificate for `*.l27powered.eu`.
+  Diagnostic requests to both the previously configured and current metadata
+  paths returned HTTP 404 after an explicitly external, non-application
+  insecure inspection. GeoIntel itself reports `tls_error` and provides no
+  bypass.
+- The complete readiness gate passed 920 backend tests, backend compilation,
+  documentation/contract audits, 115 documented API routes, Alembic head
+  `202607160001`, frontend TypeScript typecheck and the production Vite build.
+- Live Docker deployment and controlled Flanders provisioning are recorded
+  after the repository commit below.