Upgrade async GPU analysis and workbench UX

docs/API_CONTRACTS.md

@@ -1528,7 +1528,10 @@ Response:
 
 ## Detection Lab
 
-Sprint 8 implements Detection Lab foundation only. YOLO/PyTorch real inference is not enabled, no model is downloaded, and fixture detections require explicit fixture mode.
+Detection Lab exposes the governed local YOLO/PyTorch runtime only when model,
+dependencies and the configured NVIDIA accelerator pass preflight. GeoIntel
+never downloads a model implicitly; fixture detections still require explicit
+fixture mode and are not production inference.
 
 ### Guided browser orchestration
 
@@ -1537,11 +1540,17 @@ The current frontend offers one guided building-analysis action, but does not ad
 1. optional explicit `POST /api/v1/projects/{project_id}/datasets/upload` for a georeferenced GeoTIFF;
 2. `POST /api/v1/projects/{project_id}/datasets/{dataset_id}/raster/tile` with 512 px tiles and 64 px overlap;
 3. `GET /api/v1/detection/yolo/preflight` with the returned manifest and selected local model asset;
-4. `POST /api/v1/detection/run` only after successful preflight;
-5. persisted run, Detection list and Detection GeoJSON reads;
-6. optional persisted reference QA through the existing detection QA endpoint.
+4. `POST /api/v1/detection/run-async` only after successful preflight;
+5. project-bound polling through
+   `GET /api/v1/projects/{project_id}/jobs/{job_id}` until a terminal state;
+6. persisted run, Detection list and Detection GeoJSON reads;
+7. optional persisted reference QA through the existing detection QA endpoint.
 
-The strict `POST /api/v1/detection/run` contract still requires `tile_manifest_path` for configured YOLO. The frontend does not create fake tiles, bypass tile limits, fetch external imagery or download model weights.
+The strict async request contract still requires `tile_manifest_path` for
+configured YOLO. The production frontend does not fall back to the synchronous
+inference route, create fake tiles, bypass tile limits, fetch external imagery
+or download model weights. A zero-count success remains a completed inference,
+not proof that the selected area contains no objects.
 
 ### GET `/api/v1/detection/models`
 
@@ -1758,8 +1767,12 @@ rejected immediately rather than by a job that fails minutes later.
 Queued jobs are executed by the background analysis worker
 (`GEOINTEL_ANALYSIS_WORKER_ENABLED`, poll interval
 `GEOINTEL_ANALYSIS_WORKER_POLL_SECONDS`), which claims a job before dispatching
-it so the same run is never started twice. Poll `GET /api/v1/jobs/{id}` for
-progress. `POST /api/v1/segmentation/run-async` behaves identically.
+it so the same run is never started twice. Poll the project-bound
+`GET /api/v1/projects/{project_id}/jobs/{job_id}` endpoint for progress.
+`POST /api/v1/segmentation/run-async` behaves identically. Guest sessions may
+queue and read analysis only for the project id embedded in their signed
+session; query parameters never authorize a run, result or export belonging to
+another project.
 
 Unavailable model response:
 
@@ -2032,7 +2045,12 @@ Same pattern as object detection, but output includes masks and polygonized geom
 
 ## Segmentation Lab
 
-Sprint 9 implements Segmentation Lab foundation only. Real SAM and YOLO-seg inference are not enabled, no model is downloaded, and fixture segmentations require explicit fixture mode.
+Segmentation Lab exposes a configured local YOLO-seg or SAM runtime when its
+model file, immutable runtime provenance and dependencies validate. No model is
+downloaded. On the NVIDIA server, `YOLO_REQUIRE_CUDA=true` makes both configured
+segmentation adapters fail closed when CUDA is absent or `YOLO_DEVICE` selects
+CPU. Fixture segmentations remain explicit test-only data and the production
+browser never queues that model.
 
 ### GET `/api/v1/segmentation/models`
 
@@ -2043,6 +2061,9 @@ Returns segmentation model capability descriptors:
 - `yolo-seg-configured`: `not_configured`
 - `sam-configured`: `not_configured`
 
+The two configured entries become `configured` only when their corresponding
+enable flag, local model file and provenance sidecar validate.
+
 ### POST `/api/v1/segmentation/run`
 
 Creates a segmentation job and segmentation analysis run. If the requested model is unavailable, the job and analysis run are marked `failed` with `SEGMENTATION_MODEL_UNAVAILABLE`.
@@ -2063,6 +2084,16 @@ Request:
 
 Fixture segmenter mode is test/demo-only. It persists only explicit `parameters_json.fixture_segmentations` entries when `parameters_json.fixture_mode=true`; it is never invoked automatically and does not represent production inference.
 
+The production frontend uses `POST /api/v1/segmentation/run-async`, then polls
+`GET /api/v1/projects/{project_id}/jobs/{job_id}` and reconciles the terminal
+job with its persisted `AnalysisRun` and polygon records. It does not fall back
+to the synchronous route. A configured model requires an existing
+`tile_manifest_path`; missing CUDA fails with
+`SEGMENTATION_ACCELERATOR_UNAVAILABLE` or
+`SEGMENTATION_ACCELERATOR_MISCONFIGURED` when CUDA is required. A valid
+zero-polygon run is shown as an empty model result, never as proof that the AOI
+contains no relevant objects.
+
 Validation errors:
 
 - `INVALID_DATASET_TYPE` when the dataset is not raster.
@@ -2086,6 +2117,11 @@ Returns persisted segmentation records for a segmentation analysis run. Optional
 - `dataset_id`
 - `class_name`
 - `min_confidence`
+- `limit` (`0` means every matching record, otherwise capped at `50000`)
+- `offset`
+
+The response reports `total`, `limit`, `offset` and `truncated`; clients must
+not present a truncated page as the complete polygon population.
 
 ### GET `/api/v1/segmentation/datasets/{dataset_id}/segmentations`
 

docs/CODEX_EXECUTION_LOG.md

@@ -12867,3 +12867,71 @@ Open:
 - Browser emulation covers responsive layout and interaction; certification on
   physical touch hardware and with a screen reader remains a separate human QA
   activity.
+
+## 2026-08-23 - Sol Ultra product-, runtime- en betrouwbaarheidsronde
+
+### Delivered
+
+- Split the public landing foundation from the lazy workbench and MapLibre
+  styles. The initial production CSS payload dropped from roughly 219 kB to
+  38.38 kB while the authenticated workbench keeps its complete styling.
+- Extended the reproducible browser audit to cover the landing and workbench at
+  390 x 844, 1366 x 768 and 2560 x 1080, including mobile navigation,
+  keyboard tabs, loading state, advanced map flow and every guest workspace.
+- Corrected the smartphone shell hierarchy: topbar, guest banner and page
+  heading no longer overlap, and the live Selecteer/Bronnen/Verwerk/Controleer
+  rail now sits below the map actions instead of behind the fixed navigation.
+- Kept full workspace titles for headings and accessible names while shortening
+  the two mobile navigation labels to `AI-beeld` and `Export`; the browser gate
+  now rejects any visible sidebar label whose text box is clipped.
+- Made map-analysis failures outrank empty states and added an explicit retry;
+  new selections clear stale coverage immediately.
+- Replaced synchronous browser inference with governed async detection and
+  segmentation queues, project-bound job polling and persisted-run
+  reconciliation. Detection has NVIDIA preflight; segmentation now fails
+  closed under the same server CUDA contract. Zero-result runs are communicated
+  without claiming that the AOI is object-free.
+- Bound guest detection, segmentation and export reads/writes to the signed
+  demo project at the resource level. Matching query parameters can no longer
+  authorize another project's run, dataset, result or download.
+- Closed stale-response races in temporal comparison and the local GeoAI
+  assistant, plus detection/segmentation run, result and QA flows across project
+  switches. Previously visited workspaces no longer reload together after every
+  navigation change.
+- Added keyboard-complete pipeline tabs and React-driven model-dialog state,
+  initial focus and trigger-focus restoration. Landing scrolling now respects
+  `prefers-reduced-motion`.
+- Hardened outbound acquisition redirects before the redirected request is
+  opened, including origin/port and embedded-credential rejection, and fixed
+  bounded pagination for segmentation result lists.
+- Fixed segmentation readiness and section status: configured production
+  models now require a real tile manifest before queueing, fixture mode is
+  visibly test-only, and queued/running NVIDIA work has an explicit live state.
+- Localised known model registrations and availability states in the Dutch UI;
+  raw English backend placeholder copy no longer leaks into the primary model
+  selector or readiness guidance.
+
+### Verification
+
+- Frontend TypeScript check and production build passed.
+- Complete frontend suite: 36 files / 151 tests passed.
+- Relevant backend release set: 121 tests passed, covering async analysis jobs,
+  atomic claims, guest/resource isolation, redirect policy, segmentation
+  pagination, NVIDIA runtime enforcement and current AI-lab contracts.
+- Ruff passed over every changed backend Python module and test.
+- Browser evidence passed across three landing and three authenticated
+  workbench viewports with zero horizontal overflow, console errors or failed
+  API requests in `.codex-artifacts/sol-ultra-final-l/manifest.json`; focused
+  AI-workspace and segmentation screenshots are stored beside it.
+- Production build passed. Initial landing CSS remains 38.38 kB (8.22 kB
+  gzip); the lazy workbench JS is 479.76 kB (129.25 kB gzip) and MapLibre stays
+  isolated in its own lazy chunk.
+
+### Boundaries
+
+- This pass improves runtime correctness and presentation; it does not invent a
+  new accuracy claim or promote a model checkpoint. Existing governed model
+  evidence and regional release gates remain authoritative.
+- Physical touch-device and screen-reader certification remain human QA. No
+  commit or deployment was performed because the active execution brief
+  explicitly forbids committing unless requested.

docs/TODO.md

@@ -1109,6 +1109,32 @@ This file now starts with the current implementation status. Older preparation/b
 - [x] Loading-, empty-, unavailable- en errorstates plus toetsenbord- en dialogbediening.
 - [x] Zoekbare en bredere kaartthemalijst met volledig leesbare labels.
 - [x] Compacte analysecontextbalk en rustige desktop/tablet/mobiele hiërarchie.
+
+# Sprint 237 - Sol Ultra productupgrade (2026-08-23)
+
+- [x] Splits publieke landing-CSS en MapLibre van de lazy werkbankbundel.
+- [x] Valideer landing en werkbank op 390, 1366 en 2560 px zonder overflow,
+  consolefouten of mislukte API-requests.
+- [x] Herstel mobiele topbar/banner/kop- en procesrailbotsingen.
+- [x] Voorkom afgekapte mobiele navigatielabels met korte zichtlabels en een
+  automatische clipping-gate.
+- [x] Toon analysefouten vóór lege states en bied een herhaalactie.
+- [x] Wis oude dekkingsdata zodra een nieuwe AOI wordt opgelost.
+- [x] Sluit stale-response races in tijdvergelijking en AI-vragen.
+- [x] Sluit late detectie-/segmentatiejobs, resultaten en QA na een
+  werkruimtewissel uit.
+- [x] Voer productie-detectie uitsluitend via async NVIDIA/GPU-jobs uit en
+  verzoen het resultaat met de bewaarde AnalysisRun.
+- [x] Voer productie-segmentatie uitsluitend via async serverjobs uit, eis een
+  tegelmanifest en laat de NVIDIA-runtime fail-closed valideren.
+- [x] Bind gast-detecties, segmentaties en downloads aan het gesigneerde
+  demoproject op resourceniveau.
+- [x] Valideer redirects vóór netwerktoegang en begrens segmentatieresultaten.
+- [x] Maak pipeline-tabs en modeldialoog volledig toetsenbordbedienbaar.
+- [x] Lokaliseer bekende modelnamen en beschikbaarheidsmeldingen in de primaire
+  Nederlandse AI-flow.
+- [ ] Voer vóór formele toegankelijkheidscertificatie nog fysieke touch- en
+  screenreader-QA uit; browseremulatie en automatische naamcontrole zijn groen.
 - [x] Uitschuifbare inzichten behouden; analyse blijft uitsluitend expliciet na themakeuze.
 - [x] 51 frontendtests en productiebuild groen.
 - [ ] 19 verouderde broncode-stringtests herijken; meerdere eisen daarin (automatische analyse) conflicteren bewust met de actuele productbeslissing.