Complete temporal detection safety gate

docs/CODEX_EXECUTION_LOG.md

@@ -36,6 +36,27 @@
 - Local Docker CLI is unavailable on the Windows Codex host. Docker config,
   image build, live health truthfulness, backup and restore are therefore
   scheduled on the Docker-enabled Tower after push.
+- Pushed and deployed commit `9c402e0`; subsequently pushed the cwd-independent
+  backup fix `38a3bd0` and secret rotation command `fc42ea9`.
+- Tower Docker config, all-in-one build, live migration smoke and browser
+  runtime smoke passed. `/health/live` and `/health/ready` report `ok`,
+  PostGIS 3.6, Alembic `202607160001`, writable storage and configured YOLO.
+- Startup reconciliation changed five impossible orphaned jobs and two
+  analysis runs to terminal `failed` state with `PROCESS_INTERRUPTED`; no
+  `running` rows remain.
+- Created the full SHA-256 inventory backup
+  `rc-belgium-north-sea-38a3bd0`, verified it read-only and restored it in an
+  isolated temporary database. The first restore attempt exposed stale glibc
+  collation metadata in `template1`/`postgres`; those empty system databases
+  were reindexed and refreshed after the backup, then restore passed.
+- Rotated the production PostgreSQL password with a generated 256-bit value
+  without logging it, atomically updated the Tower `.env` and recreated the
+  healthy container.
+- Created the current secure backup
+  `rc-belgium-north-sea-fc42ea9-secure` (1.4 GiB), verified all checksums and
+  repeated isolated restore. PostGIS/Alembic and all retained critical table
+  counts match; the temporary database was removed.
+- RC-1 and RC-2 are complete. RC-3 is active.
 
 ## Sprint 229 - Governed ALZ definitive release promotion (2026-07-17)
 
@@ -10340,3 +10361,36 @@ Validation:
   TypeScript typecheck and the production Vite build.
 - Tower deployment and browser acceptance results are recorded after the
   rebuilt all-in-one runtime is verified.
+## 2026-07-17 - Belgium/North Sea RC-3 local gate
+
+- Removed automatic selection and every `rasterDatasets[0]` execution fallback
+  from Detection Lab. Normal detection, guided preparation and calibration now
+  require an explicit raster selection.
+- Added `TemporalCompatibilityService`. Official raster editions carrying
+  `supports_detection=false` fail before Job/AnalysisRun creation with
+  `DETECTION_SOURCE_TEMPORALLY_UNSUPPORTED`.
+- Detection QA now loads the persisted source Dataset and rejects historical
+  candidate/reference periods that are absent or non-overlapping with
+  `DETECTION_QA_TEMPORAL_MISMATCH`.
+- Compatible temporal evidence is persisted under
+  `parameters_json.temporal_compatibility` and
+  `findings_json.temporal_compatibility` on the existing QualityCheck.
+- Added sanitized request IDs, request-duration logs and correlated detection
+  start/QA completion logs.
+- Added `scripts/runtime_state_report.py`; default mode is read-only and
+  mutation requires `--reconcile --confirm reconcile-interrupted-runtime`.
+
+Validation:
+
+- `python -m compileall backend/app`: passed.
+- `python -m pytest backend`: 974 passed.
+- `npm run typecheck`: passed.
+- `npm run build`: passed.
+- `bash scripts/run_readiness_check.sh`: passed, including 122-route API audit,
+  974 tests, Alembic head, typecheck and build.
+- `python -m alembic heads`: one head, `202607160001`.
+- `python -m alembic upgrade head --sql`: passed.
+- backup/restore/live-smoke shell syntax checks: passed.
+- Local `docker compose config` was unavailable because this Windows
+  workstation has no Docker CLI; Tower validation remains mandatory before
+  RC-3 completion.

docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md

@@ -144,9 +144,9 @@ editions and licences must still pass source-specific probes before activation.
 | Phase | State | Purpose |
 | --- | --- | --- |
 | RC-0 | complete | freeze scope and produce release evidence baseline |
-| RC-1 | in progress | backup, restore and data safety |
-| RC-2 | verification pending | health, capabilities and stale-runtime correctness |
-| RC-3 | pending | temporal detection/QA correctness and observability |
+| RC-1 | complete | backup, restore and data safety |
+| RC-2 | complete | health, capabilities and stale-runtime correctness |
+| RC-3 | in progress | temporal detection/QA correctness and observability |
 | RC-4 | pending | national/maritime scope and provider coverage contracts |
 | RC-5 | pending | deployment, secrets, configuration, fresh install and rollback |
 | RC-6 | pending | complete CI, dependency and supply-chain gates |
@@ -190,6 +190,12 @@ Runtime evidence is stored outside Git under `storage/release-evidence/`.
 
 ## RC-1 - Backup, restore and data safety
 
+**State: complete.** Tower retains the checksum-verified 1.4 GiB backup
+`rc-belgium-north-sea-fc42ea9-secure`. Its manifest records a non-default
+database password. An isolated restore reached PostGIS 3.6 and Alembic
+`202607160001`, reconciled every retained critical table count and removed the
+temporary database.
+
 ### Work
 
 - Add a safe production backup command for PostgreSQL custom-format dumps.
@@ -219,8 +225,11 @@ Runtime evidence is stored outside Git under `storage/release-evidence/`.
 
 ## RC-2 - Truthful runtime state
 
-**State: implementation complete, live verification pending.** Local compile,
-963 backend tests, frontend typecheck/build and the full readiness gate pass.
+**State: complete.** Local compile, 963 backend tests, frontend
+typecheck/build and the full readiness gate pass. Tower reports green
+DB/PostGIS/migration/storage readiness and configured YOLO capability. Startup
+reconciled five orphaned jobs and two orphaned analysis runs; zero remain
+`running`.
 
 ### Work
 
@@ -253,6 +262,11 @@ Runtime evidence is stored outside Git under `storage/release-evidence/`.
 
 ## RC-3 - Temporal QA correctness and observability
 
+**State: implementation complete; live deployment acceptance pending.** The
+local release gate passes backend compilation, all 974 backend tests, frontend
+typecheck/build, the integrated readiness script, one Alembic head and complete
+offline migration SQL generation.
+
 ### Work
 
 - Stop Detection Lab from silently selecting the first raster.

docs/ROLLBACK_AND_RECOVERY.md

@@ -32,3 +32,10 @@ Storage and model files are inventoried rather than copied into the database
 dump. Release backups must therefore be paired with the persistent storage
 volume backup policy. Use `--inventory-mode sha256` for final release
 evidence.
+
+An old persistent volume can also retain glibc collation metadata for the
+empty `postgres` and `template1` system databases. If `createdb` fails for that
+reason, first complete and verify the production backup, then reindex each
+affected system database and run `ALTER DATABASE <name> REFRESH COLLATION
+VERSION`. Never refresh before reindexing, and never treat this maintenance as
+a substitute for the isolated restore proof.

docs/TODO.md

@@ -10,9 +10,9 @@ maritieme zones.
 - [x] RC-0: Belgische en maritieme scopefreeze vastleggen.
 - [x] RC-0: autonome roadmap zonder afzonderlijke RC-12 vastleggen.
 - [x] RC-0: deterministisch release-evidence manifest implementeren en draaien.
-- [ ] RC-1: actuele productiebackup, verificatie en geisoleerde restore bewijzen.
-- [ ] RC-2: liveness/readiness/capabilities fail-closed en waarheidsgetrouw maken.
-- [ ] RC-2: verweesde jobs en analysis runs na een procesherstart verzoenen.
+- [x] RC-1: actuele productiebackup, verificatie en geisoleerde restore bewijzen.
+- [x] RC-2: liveness/readiness/capabilities fail-closed en waarheidsgetrouw maken.
+- [x] RC-2: verweesde jobs en analysis runs na een procesherstart verzoenen.
 - [ ] RC-3: expliciete rasterkeuze en temporeel compatibele detectie-QA afdwingen.
 - [ ] RC-4: nationale basisdekking, Wallonie, Brussel en Belgische Noordzee via
   beheerde providers en golden areas operationaliseren.