feat: add governed nationwide AOI orchestration and CUDA enforcement

docs/CODEX_EXECUTION_LOG.md

@@ -11346,3 +11346,85 @@ Validation:
 - added backend API/service tests for multilingual/NIS search and persisted-area activation;
 - added frontend tests for live search, activation and explicit optional/free-selection semantics;
 - visually inspected the 512 px application mark and 32 px favicon derivative.
+## 2026-07-26 - Audit remediation roadmap and NVIDIA GPU contract
+
+Implemented:
+
+- translated the platform audit into `docs/AUDIT_REMEDIATION_ROADMAP.md`, with
+  gated waves for NVIDIA runtime truth, general AOI orchestration, coverage
+  evidence, missing sources, model validation and release proof;
+- made the Unraid production contract explicitly NVIDIA/CUDA-based through a
+  CUDA PyTorch wheel index, `gpus: all`, `YOLO_DEVICE=cuda:0` and
+  `YOLO_REQUIRE_CUDA=true`;
+- added fail-closed accelerator validation to YOLO model loading and preflight,
+  including explicit unavailable/misconfigured errors instead of CPU fallback;
+- extended the preflight response with accelerator readiness, configured device
+  and CUDA-required state, and updated the API, AI and dependency documentation;
+- retained CPU as an allowed local-development default only when CUDA is not
+  explicitly required.
+
+Validation:
+
+- 57 focused backend tests passed for YOLO inference, preflight and Docker
+  runtime configuration;
+- backend application byte-compilation passed;
+- local Compose rendering could not run because this Windows workstation has no
+  `docker` CLI. Tower rebuild, `nvidia-smi`, CUDA-enabled PyTorch preflight and
+  one bounded persisted GPU inference smoke remain the live Wave 0 exit gate.
+
+Known limitations and next pass:
+
+- these repository changes do not prove that the deployed Tower container can
+  see the physical GPU; do not claim GPU readiness until the live gate passes;
+- next implement the persisted parent/partition/checkpoint operation as the
+  first Wave 1 vertical slice, reusing existing job and provider services.
+## 2026-07-26 - Audit remediation: resumable AOI federation and truthful AI runtime
+
+Implemented:
+
+- added migration `202607260001` with persisted AOI parent operations and
+  deterministic child partitions, exact EPSG:31370 planning, zone clipping,
+  checkpoints, attempt budgets, child Jobs and restart reconciliation;
+- added a production background worker that automatically claims queued work
+  and dispatches ten existing governed providers without introducing a second
+  Dataset persistence path;
+- aggregated child Dataset identities, completeness and source-aware vector
+  deduplication/raster mosaic contracts into one parent result and exposed live
+  progress plus failures in the System workspace;
+- removed the frontend overview/detail refusal for on-demand themes and routed
+  regional/overview acquisition through the resumable server operation;
+- made coverage resolution accept a spatial union of bounded partitions only
+  when it covers the selection, and exposed authority, edition, time, CRS,
+  resolution, bbox, attribution, licence and checksum evidence per Dataset;
+- corrected the active YOLO contract to building-only, fail-closed CUDA and
+  persisted Mol/Kempen Area scope. Production cannot advertise configured AI
+  from a CPU runtime or execute an unvalidated class/area.
+
+Validation:
+
+- one Alembic head (`202607260001`) and a complete 40,888-byte offline SQL
+  migration chain were generated;
+- 71 focused backend tests, 40 frontend tests, frontend typecheck and production
+  build passed;
+- the broader Windows-compatible backend gate passed 1,115 tests with five
+  WSL-dependent shell tests deselected because the workstation WSL VHD is
+  missing; those Linux shell gates remain mandatory on Tower;
+- API contract audit passed with all 146 routes documented.
+
+Live pre-deploy evidence:
+
+- Tower is healthy on PostGIS 3.6 at migration `202607160001`;
+- the host has an NVIDIA GeForce RTX 4080 SUPER with 16,376 MiB and driver
+  595.71.05;
+- the old container confirms the audited failure state: no Docker device
+  request, `torch 2.13.0+cpu`, CUDA false and zero visible GPUs;
+- the official Vlaanderen catalog still identifies MDK Version 8, 20 m, LAT as
+  live production data, but both catalogued HTTPS host variants fail strict TLS
+  and HTTP does not expose the WCS path. MDK remains `not_configured`; TLS is not
+  bypassed.
+
+Next gate:
+
+- commit/push the immutable source, deploy on Tower, run the Linux readiness and
+  migration gates, prove CUDA PyTorch plus a bounded persisted inference, and
+  capture golden AOI/coverage evidence.