Upgrade async GPU analysis and workbench UX

docs/API_CONTRACTS.md

@@ -1528,7 +1528,10 @@ Response:
 
 ## Detection Lab
 
-Sprint 8 implements Detection Lab foundation only. YOLO/PyTorch real inference is not enabled, no model is downloaded, and fixture detections require explicit fixture mode.
+Detection Lab exposes the governed local YOLO/PyTorch runtime only when model,
+dependencies and the configured NVIDIA accelerator pass preflight. GeoIntel
+never downloads a model implicitly; fixture detections still require explicit
+fixture mode and are not production inference.
 
 ### Guided browser orchestration
 
@@ -1537,11 +1540,17 @@ The current frontend offers one guided building-analysis action, but does not ad
 1. optional explicit `POST /api/v1/projects/{project_id}/datasets/upload` for a georeferenced GeoTIFF;
 2. `POST /api/v1/projects/{project_id}/datasets/{dataset_id}/raster/tile` with 512 px tiles and 64 px overlap;
 3. `GET /api/v1/detection/yolo/preflight` with the returned manifest and selected local model asset;
-4. `POST /api/v1/detection/run` only after successful preflight;
-5. persisted run, Detection list and Detection GeoJSON reads;
-6. optional persisted reference QA through the existing detection QA endpoint.
+4. `POST /api/v1/detection/run-async` only after successful preflight;
+5. project-bound polling through
+   `GET /api/v1/projects/{project_id}/jobs/{job_id}` until a terminal state;
+6. persisted run, Detection list and Detection GeoJSON reads;
+7. optional persisted reference QA through the existing detection QA endpoint.
 
-The strict `POST /api/v1/detection/run` contract still requires `tile_manifest_path` for configured YOLO. The frontend does not create fake tiles, bypass tile limits, fetch external imagery or download model weights.
+The strict async request contract still requires `tile_manifest_path` for
+configured YOLO. The production frontend does not fall back to the synchronous
+inference route, create fake tiles, bypass tile limits, fetch external imagery
+or download model weights. A zero-count success remains a completed inference,
+not proof that the selected area contains no objects.
 
 ### GET `/api/v1/detection/models`
 
@@ -1758,8 +1767,12 @@ rejected immediately rather than by a job that fails minutes later.
 Queued jobs are executed by the background analysis worker
 (`GEOINTEL_ANALYSIS_WORKER_ENABLED`, poll interval
 `GEOINTEL_ANALYSIS_WORKER_POLL_SECONDS`), which claims a job before dispatching
-it so the same run is never started twice. Poll `GET /api/v1/jobs/{id}` for
-progress. `POST /api/v1/segmentation/run-async` behaves identically.
+it so the same run is never started twice. Poll the project-bound
+`GET /api/v1/projects/{project_id}/jobs/{job_id}` endpoint for progress.
+`POST /api/v1/segmentation/run-async` behaves identically. Guest sessions may
+queue and read analysis only for the project id embedded in their signed
+session; query parameters never authorize a run, result or export belonging to
+another project.
 
 Unavailable model response:
 
@@ -2032,7 +2045,12 @@ Same pattern as object detection, but output includes masks and polygonized geom
 
 ## Segmentation Lab
 
-Sprint 9 implements Segmentation Lab foundation only. Real SAM and YOLO-seg inference are not enabled, no model is downloaded, and fixture segmentations require explicit fixture mode.
+Segmentation Lab exposes a configured local YOLO-seg or SAM runtime when its
+model file, immutable runtime provenance and dependencies validate. No model is
+downloaded. On the NVIDIA server, `YOLO_REQUIRE_CUDA=true` makes both configured
+segmentation adapters fail closed when CUDA is absent or `YOLO_DEVICE` selects
+CPU. Fixture segmentations remain explicit test-only data and the production
+browser never queues that model.
 
 ### GET `/api/v1/segmentation/models`
 
@@ -2043,6 +2061,9 @@ Returns segmentation model capability descriptors:
 - `yolo-seg-configured`: `not_configured`
 - `sam-configured`: `not_configured`
 
+The two configured entries become `configured` only when their corresponding
+enable flag, local model file and provenance sidecar validate.
+
 ### POST `/api/v1/segmentation/run`
 
 Creates a segmentation job and segmentation analysis run. If the requested model is unavailable, the job and analysis run are marked `failed` with `SEGMENTATION_MODEL_UNAVAILABLE`.
@@ -2063,6 +2084,16 @@ Request:
 
 Fixture segmenter mode is test/demo-only. It persists only explicit `parameters_json.fixture_segmentations` entries when `parameters_json.fixture_mode=true`; it is never invoked automatically and does not represent production inference.
 
+The production frontend uses `POST /api/v1/segmentation/run-async`, then polls
+`GET /api/v1/projects/{project_id}/jobs/{job_id}` and reconciles the terminal
+job with its persisted `AnalysisRun` and polygon records. It does not fall back
+to the synchronous route. A configured model requires an existing
+`tile_manifest_path`; missing CUDA fails with
+`SEGMENTATION_ACCELERATOR_UNAVAILABLE` or
+`SEGMENTATION_ACCELERATOR_MISCONFIGURED` when CUDA is required. A valid
+zero-polygon run is shown as an empty model result, never as proof that the AOI
+contains no relevant objects.
+
 Validation errors:
 
 - `INVALID_DATASET_TYPE` when the dataset is not raster.
@@ -2086,6 +2117,11 @@ Returns persisted segmentation records for a segmentation analysis run. Optional
 - `dataset_id`
 - `class_name`
 - `min_confidence`
+- `limit` (`0` means every matching record, otherwise capped at `50000`)
+- `offset`
+
+The response reports `total`, `limit`, `offset` and `truncated`; clients must
+not present a truncated page as the complete polygon population.
 
 ### GET `/api/v1/segmentation/datasets/{dataset_id}/segmentations`